deslogin-1.3/004075500001450000013000000000000572743343300142345ustar00barrettsystem00000000000000deslogin-1.3/README000064400001450000013000000077530572572700500151230ustar00barrettsystem00000000000000This package provides a network login service with more secure authentication than telnet or rlogin. Also, all data transmitted to and from the remote host in encrypted using the DES. Thus, this package allows you to use a remote host across untrusted networks without fear of network snooping. The package creates two executables: a daemon which runs on the host you wish to login to, and a client which runs on the host(s) you wish to login from. To install, just follow the instructions in the Makefile. To use, read the man pages for deslogin.1 and deslogind.1. They provide many helpful hints and security tips. The cipher program is included here from my previous cipher distribution. Dave Barrett barrett@asgard.cs.colorado.edu deslogind tested on the following machines: UNICOS 8.0.2.1A CRAY Y-MP - under construction SunOS 5.3 sun4m sparc - under construction (contact me if it works!) SunOS 5.4 sun4d sparc - tested as non-root user by barrett 25-Jan-95 Dynix 3.2.0 sequent i386 - tested as non-root user by skrenta 25-Jan-95 AIX 2 3 RS/6000 - client only gl8f@fermi.clas.virginia.edu IRIX 4.0.5MM IP12 - client OK; server can't get pty. IRIX 4.0.5 IP7 - same as IRIX? dgux 5.4R2.01 mc88100 - works, except tty modes incorrect Linux 1.0.9 #2 i486 - fully functional as of version 1.1 Linux 1.1.11 #2 i486 - fully functional as of version 1.2 HP-UX B.09.00 B 9000/370 - fully functional except -w option OSF1 V2.0 240 alpha - fully functional SunOS 4.1.1 1 sun4c - fully functional ULTRIX 4.3 1 RISC - works, but /dev/tty inaccessable ULTRIX 4.2 0 RISC - works, but /dev/tty inaccessable - ctrl-z aborts session. Release 1.0 April 1994. Release 1.1 14-June 1994: Added RHOSTNAME environment variable. Added -w option. Ported code to linux. Now compiles with no changes. Incorporated the bug-fix patch for 1.0. Added logging to wtmp for correct login history. Minor fixes to clean up warnings with gcc -ansi -pedantic -Wall. Release 1.2: Never happened. Many fixes distributed over several months by email to people who asked. I Was waiting for Solaris and SGI port which never happened. Release 1.30 25-Jan-95: (alpha release only, never distributed via ftp) Added WRITE_RETRY_TIME to txfr.c Ported deslogind to SunOS 5.4 Ported to Sequent Dynix i386 Ported client and server to AIX 3.2.5 RS/6000 Release 1.32 03-Mar-95: Completely rewrote utmp.c and utmp.h to repair various utmp problems (especially SOLARIS ) (added -DUTMPX) This also fixed utmp problems with linux as well. (tested 2-Mar-95) DEC MIPS Ultrix Note: I think the problem may be related to POSIX/BSD implementation on the DEC MIPS machine. The parent process had acquired the fd as a controlling terminal even though O_NOCTY was specified. The tcsetpgrp call returned success, but I'm not sure I believe it. If anyone knows about controlling terminal stuff on the MIPS, please contact me. I have comments in deslogind.c and tty.c on what I attempted. Hewlett-Packard HP-UX Note: The wrapper option (-w) will not work with HP-UX yet. The login program refuses to be run unless from a root shell; I'm still working on it for the next release. Solaris Notes: Solaris was a mess. Had to add streams modules and hack like crazy on utmp.c. deslogind now modifies utmp records correctly! If you have problems with utmpx records, remove the -DUTMPX from CCFLAGS, athough this was stated as working by . Independently of -DUTMPX, I've been told that the "idle time" shows up negative. IRIX (SGI) Notes: I have been unable to obtain documentation on how to acquire a controlling terminal reliably in a machine-independent way using the AT&T streams modules. Specifically, I don't have the documentation for the "ptem" or "ldterm" and "ttycompat" streams modules. If you know how to do this, please contact me. e -DUTMPX from CCFLAGdeslogin-1.3/Makefile000064400001450000013000000454500572743341000156730ustar00barrettsystem00000000000000# # You must get the source code for cipher first; then edit DESDIR. # ftp.uu.net:/pub/security/des/cipher-3.0.tar.Z # # Find the set of lines which corresponds to your configuration, and uncomment # them. If you have a machine not listed here, the most likely configuration # to work is the one for SunOS 4.1.1, or Gnu CC. # # Type "make". # # If you get the error "Don't know how to make target `desblock.o'", just type # "make" again; this is a symlink dependency which was resolved by the 1st make. # This shouldn't happen anymore, but I thought I'd mention it just in case. # # You will have to supply a default decryption key if you wish to compile # the server process "deslogind". # # If everything compiles, type "make install" to see how to finish # installation and configuration. # # Read the man pages for deslogin and deslogind with "nroff -man" # # Test your installation. Login via deslogin. Verify the following: # The "who -a" command prints your correct username, tty, login time, # deslogind's pid, and remote host. # The "tty" command prints your correct login pty. # The pty returned by the tty command has correct ownership and permissions. # The "groups" command prints your correct supplementary group id's. # The "id" command prints your correct user/group name and id. # The "last -10" command prints correct login name. # Interrupt and job-control signals (usually Ctl-C, Ctl-Z) work correctly # Reading and writing from /dev/tty work correctly. # Login as a user without a .profile/.login file, and verify that # the environment is initialized the same as the login program. # Examine the deslogind log file for warnings or error messages. # Kill the current shell with signal SIGILL using the command "kill -4 $$" # verify "who -a": id=, term=132, exit=0 # verify that the date and time are the time of the process death. # verify that the duration of the login was correct. # Repeat the previous test, but exit with the command "exit 99". # verify "who -a": id=, term=0, exit=99 # Verify that "last -10" shows the correct information. # # If you must create a new configuration, see the comments below. # # Dave Barrett (barrett@asgard.cs.Colorodo.EDU # # Makefile RCS: $Revision: 1.10 $ $Date: 95/03/08 02:30:33 $ # SHELL=/bin/sh CC=@echo "you really must edit the makefile for your machine"; exit 1 # # For "make install" # MANDIR=/usr/local/man/man1 BINDIR=/usr/local/bin # # Get cipher-3.0.tar.Z from ftp.uu.net:/pub/security/des # and untar it into $(DESDIR) # DESDIR = ../cipher-3.0 # # When using a dialup line to a non-slip capable terminal server, there # is a package which allows you to multiplex the serial line. See # sunsite.unc.edu:/pub/Linux/apps/comm/term/term/term117.tar.gz for details. # For term installations - Set these variables to point to the right place # You must have compiled term before making this so that client.a exists # # If you don't know what this means, just leave these lines as they are. # # Thanks to Mark (Mookie) mark@netsys.com for adding this feature. # TERMDIR= TERMLIBS= TERMINC= TERMDEFINES= TERMBIN= ##Example: #TERMDIR=/work/term114 #TERMLIBS=$(TERMDIR)/client.a #TERMINC=$(TERMDIR) #TERMDEFINES=-I$(TERMINC) -DTERM_LINK #TERMBIN=termdeslogin # # Configuration options to deslogind. Others in deslogind.c and deslogin.h # should be correct; if not, see note above "LOGINDFLAGS" below. # USER_FILE=\"/usr/local/etc/deslogind.users\" LOG_FILE=\"/usr/adm/deslogind.log\" GW_LOG_FILE=\"/usr/adm/deslogingw.log\" # LOGIN_PROC is only used for the -w option to deslogind; nowhere else. LOGIN_PROG=\"/bin/login\" # # Add -D_USE_SYSLOG to NSTCFLAGS if you want to log messages via to syslogd # instead of the logfile. It only affects code in the file log.c. I prefer to # use a logfile instead of syslogd so that I don't have to worry about a hostile # user hijacking the connection to syslogd, or installing a Trojan horse for # for syslogd, or, even worse, having syslogd be on a remote unsecure machine. # This feature may go away when I add encryption to the logging facility. # # Add -D_USE_STREAMS if you prefer to use System V style streams for pty # handling. Some machines require this for pty.c to work correctly. # #DEBUG=-g DEBUG=-O # -D_USE_SYSLOG ## HP-UX Ansi C compiler #CC = cc -Aa #CFLAGS = $(DEBUG) #LDFLAGS = $(DEBUG) -Wl,-a,archive -s #NSTCFLAGS=$(DEBUG) -D_HPUX_SOURCE # make non-posix symbols visable ## HP-UX C++ compiler (won't work because typedef pfv in posignal.h) #CC = CC #CFLAGS = $(DEBUG) #LDFLAGS= $(DEBUG) -Wl,-a,archive # -s #NSTCFLAGS=$(DEBUG) -D_HPUX_SOURCE ## DEC MIPS Ultrix 4.3 ANSI C compiler #CC = cc -std -non_shared #CFLAGS = $(DEBUG) #LDFLAGS = $(DEBUG) -non_shared # -s #NSTCFLAGS=$(DEBUG) -DONLCR=0x00000004 ## DEC MIPS Ultrix 4.2 Non-ANSI C compiler #CC = cc -YPOSIX #CFLAGS = $(DEBUG) #LDFLAGS = $(DEBUG) -YSYSTEM_FIVE # -s #NSTCFLAGS=$(DEBUG) -D__MIPS -DONLCR=0x00000004 ## DEC Alpha OSF/1 C compiler #CC = cc -std -non_shared #CFLAGS = $(DEBUG) #LDFLAGS = $(DEBUG) -non_shared # -s #NSTCFLAGS=$(DEBUG) -D_XOPEN_SOURCE -D_OSF_SOURCE -D__ALPHA ## DEC Alpha OSF/1 C++ compiler (OSF1 V2.0 240 alpha) ## don't enable -O: generates incorrect code: progName output as junk #CC = cxx -non_shared #CFLAGS = $(DEBUG) #LDFLAGS =$(DEBUG) -non_shared # -s #NSTCFLAGS=$(DEBUG) -non_shared -D_XOPEN_SOURCE -D_OSF_SOURCE -D__ALPHA ## ONLCR, non-posix symbols, controlling terminal ## Sun SPARC SunOS 4.1.1 BSD C compiler ## ## Must add -DWTMP_FILE=\"/var/adm/wtmp\" on installations that ## don't have #define WTMP_FILE in /usr/include/utmp.h. ## #CC = cc #CFLAGS =$(DEBUG) -Bstatic -Dsparc # need -Dsparc if missing atexit #LDFLAGS =$(DEBUG) -Bstatic # -s #NSTCFLAGS=$(DEBUG) -Bstatic -Dsparc -DONLCR=0x00000004 ## Sun Sun3 SunOS 4.1 BSD C compiler #CC = cc #CFLAGS =$(DEBUG) -Bstatic -Dsun3 #LDFLAGS =$(DEBUG) -Bstatic # -s #NSTCFLAGS=$(DEBUG) -Bstatic -Dsun3 -DONLCR=0x00000004 ## Data General DG/UX 5.4.R2.01 Gnu Compiler #CC = gcc -static #CFLAGS = $(DEBUG) -DDGUX #LDFLAGS = $(DEBUG) #NSTCFLAGS= $(DEBUG) -DDGUX ## SGI MIPS IRIX ANSI C Compiler using _getpty ## ## -D__sgi necessary to compile utmp.c pty.c ## -D__EXTENSIONS__ for _getpty declaration in for pty.c ## ## SGI in their infinite wisdom has decided not to support non-shared libraries ## by default as of IRIX 5.1.1.2. This feature causes serious security ## problems because there are subtle ways to trojan horse library calls. ## If at all possible, install /usr/lib/nonshared and compile and link with ## the -non_shared option. ## #CC = cc -ansi -non_shared #CFLAGS = $(DEBUG) -D__sgi -D__EXTENSIONS__ #LDFLAGS = $(DEBUG) -non_shared #NSTCFLAGS= $(DEBUG) -D__sgi -D_XOPEN_SOURCE -D__EXTENSIONS__ ## SGI MIPS IRIX C Compiler using _getpty. ## ## IRIX 5.1.1.2 will not compile with -ansi because the include file for ## tcp.h won't compile a u_char bitfield. ## #CC = cc -non_shared #CFLAGS = $(DEBUG) -D__sgi #LDFLAGS = $(DEBUG) -non_shared #NSTCFLAGS= $(DEBUG) -D__sgi -D_XOPEN_SOURCE ## SGI MIPS IRIX ANSI C Compiler ## using AT&T System V Streams Package instead of _getpty. ## ## (fails to work as of 08-Mar-95 ) ## #CC = cc -ansi -non_shared #CFLAGS = $(DEBUG) -D__sgi -D_USE_STREAMS #LDFLAGS = $(DEBUG) -non_shared #NSTCFLAGS= $(DEBUG) -D__sgi -D_XOPEN_SOURCE ## ## Solaris ## ## C Compiler (cc) or Gnu C compiler (gcc) ## ## Dynamic linking is required because NIS (alias yp) routines ## require it (as listed under "BUGS" in the man page for getpwent). ## ## SunOS 5.4 cc ## SunOS 5.3 gcc 2.5.8 ## SunOS 5.4 gcc 2.6.0 requires -D__EXTENSIONS__ for struct timeval ## SunOS 5.4 requires -Dtimespec=_timespec to fix problem in sys/types.h ## when __EXTENSIONS__ is defined. I don't use timespec anyway. ## Tested by 25-Jan-95 ## ## -DUTMPX if you want utmpx & wtmpx records updated in addition to utmp & wtmp. ## Tested by 04-Mar-95 ## #CC = cc #CC = gcc #CFLAGS = $(DEBUG) -D__SOLARIS__ -D_USE_STREAMS -DUTMPX #LDFLAGS = $(DEBUG) #NSTCFLAGS= $(DEBUG) -D__SOLARIS__ -D_USE_STREAMS -D_XOPEN_SOURCE -D__EXTENSIONS__ -Dtimespec=_timespec #LIBS = -lsocket -lnsl ## Cray UNICOS Compiler (untested) #CC = cc #CFLAGS = $(DEBUG) -D__UNICOS__ #LDFLAGS = $(DEBUG) #NSTCFLAGS= $(DEBUG) -D__UNICOS__ -D_XOPEN_SOURCE ## Sequent Dynix 386 (untested) ## -D__DYNIX__ needed for utmp.c txfr.c ## _SEQUENT_ and i386 are the normal compiler predifines #CC = cc #CFLAGS = $(DEBUG) -D__DYNIX__ #LDFLAGS = $(DEBUG) #NSTCFLAGS= $(DEBUG) -D__DYNIX__ -D_XOPEN_SOURCE #LIBS = -lseq -linet -lnsl -lsocket -linet ## BSD/386 1.1 0 i386 gcc - Probably any net/2. #LOG_FILE=\"/var/log/deslogind.log\" #GW_LOG_FILE=\"/var/log/deslogingw.log\" #LOGIN_PROG=\"/usr/bin/login\" #CC =gcc -ansi #CFLAGS =$(DEBUG) #LDFLAGS =$(DEBUG) #NSTCFLAGS=$(DEBUG) -D__bsdi__ -D_USE_SYSLOG ## Gnu C compiler #CC = gcc -ansi #CFLAGS = $(DEBUG) #LDFLAGS = $(DEBUG) ## Gnu C compiler with lots of warnings (not useful except for debugging) #CC = gcc -ansi -pedantic #CFLAGS = $(DEBUG) -Wall #LDFLAGS = $(DEBUG) #NSTCFLAGS=$(DEBUG) -Wall -D_HPUX_SOURCE #NSTCFLAGS=$(DEBUG) -D_XOPEN_SOURCE -D_OSF_SOURCE -D__ALPHA ## Linux GNU C compiler ## -D_LINUX_SOURCE is necessary for to compile getkey.c for cipher. ## If you already have cipher installed, you don't need the one here. #CC = gcc -ansi #CFLAGS = $(DEBUG) -Dlinux -D_LINUX_SOURCE #LDFLAGS = $(DEBUG) #NSTCFLAGS= $(DEBUG) -Dlinux ## AIX 3.2.5 GNU C compiler (not tested) ## -DAIX necessary for txfr.c ## -DONLCR necessary for tty.c #CC = gcc -ansi #CFLAGS = $(DEBUG) -DAIX #LDFLAGS = $(DEBUG) #NSTCFLAGS= $(DEBUG) -DAIX -DONLCR=0x00000004 # Gnu C++ compiler cannot handle old-style function argument declaratons # If you figure out how to make it accept them, please send mail to the author. # # If you have to read this comment, send mail to barrett@asgard.cs.Colorado.EDU. # The file "Notes" includes some old notes I wrote which may help you. # # Non-standard object files require special non-posix features be available in # order to compile and link. NSTCFLAGS are flags to the compiler to make # non-posix symbols and features available. # # Here are the problem areas in porting to new machines: # # log.c: vsprintf must return an int. If it doesn't, you have a # non-ANSI machine. It also needs ANSI's stdarg.h. # The default source should work, since it tries to detect these. # openlog doesn't return a value on some BSD machines. # tty.c: If you don't have POSIX termios, you're hosed. This code is # completely POSIX except: The flag ONLCR is not part of POSIX. # Some machines require an ioctl to acquire the controlling terminal # for the session leader. See the function mkCtrlTty. # txfr.c: depends heavily upon the BSD select(2) semantics, which are # only vaguely documented. If the code runs incorrectly here, # it's a bitch to diagnose and fix. # socket.c: Networking isn't POSIX yet. This isolates all networking calls. # posignal.h: The arguments to a signal handler are machine-specific. # pty.c: Many newer POSIX style machines do pty stuff completely # differently from eachother. I've had to hack this a bit. # # If any of the above files fail to compile, it's most likely because the # header files on your system require a compilation option to make non-posix # symbols visible. For example, declares u_short which is # required to compile socket.c. To get around this problem, I've not defined # _POSIX_SOURCE until *after* and are included, # which "fixes" the problem on most machines. For the ONLCR problem, # grep for "ONLCR" in /usr/include{/sys}/termio*.h. Once you find that # symbol, look for an #ifdef to enable it and add that flag to NSTCFLAGS # in this Makefile. # # Make *SURE* to enable the compile options to not use shared libraries or # run-time procedure binding because it enables a serious trojan horse. # Many vendors enable dynmaic binding by default; so be careful. # # The include files and source is constructed to make it easy to change some # of the default source in this makefile rather than hacking on the C source # directly. This will make your life easier when new releases come out. # Just add a "-D=" to LOGINDFLAGS below. For example see # the -DLOG_FILE=...below. All these values have suitable defaults. You # don't need to touch them unless you want to or I've set them incorrectly by # default. # # deslogin.h: # SETUP_TIMEOUT ms for login sequence handshake # LOGIN_TIMEOUT seconds to wait for passphrase response # INACTIVITY_TIMEOUT seconds of no I/O activity before terminationg session # DESLOGIN_PORT "Well-known" Port to post listen to for deslogind # SERVICE_NAME The name of the deslogin service in /etc/services # LOGIN_PROG Full pathname of login program for -w option # # deslogind.c: # DEFAULT_UMASK Passed to umask(2) upon login. # TTY_MODE Permissions for controlling terminal slave pty device # USERPATH Default path # SYSTEMPATH Default path for user id 0. # DEFAULT_TERM What to set the TERM envt variable to. # USER_FILE Path of file containing passphrase username pairs # NOLOGIN_FILE File which denies all logins containing denial message # LOG_FILE Where to output all logging messages # # txfr.c: # WRITE_RETRY_TIME ms timeout for EAGAIN error on write attempt # # Don't change anything below this line unless you are porting to a new # incompatable platform and the existing configuration fails to work. LOGINDFLAGS=-DUSER_FILE=$(USER_FILE) -DLOG_FILE=$(LOG_FILE) -DLOGIN_PROG=$(LOGIN_PROG) GWFLAGS=-DGW_LOG_FILE=$(GW_LOG_FILE) DESSRC = desblock.c deskey.c descfb.c sboxp.c DESBINSRC = cipher.c getkey.c DESBINOBJ = $(DESBINSRC:.c=.o) DESOBJ = $(DESSRC:.c=.o) DESHDR = cipher.h des.h desdefs.h DESMAN = cipher.1 DIST = deslogin CLIHDR = posignal.h tty.h auth.h txfr.h socket.h log.h deslogin.h utmp.h SERHDR = $(CLIHDR) pty.h group.h HDR = $(SERHDR) CSRC = deslogin.c deslogind.c deslogingw.c log.c pty.c socket.c txfr.c \ group.c tty.c posignal.c utmp.c auth.c gendeskd.c MANSRC = deslogin.1 deslogind.1 NSTOBJ = socket.o txfr.o group.o OBJS = $(DESSRC:.c=.o) $(DESBINSRC:.c=.o) $(CSRC:.c=.o) BINS = deslogin deslogingw cipher deslogind gendeskd $(TERMBIN) SRC = README Makefile deslogind.users Notes keymsg \ $(HDR) $(CSRC) $(MANSRC) COMOBJ = tty.o posignal.o auth.o log.o $(DESOBJ) all: $(BINS) deslogin: deslogin.o $(COMOBJ) socket.o txfr.o utmp.o $(CC) $(LDFLAGS) -o $@ $@.o $(COMOBJ) socket.o txfr.o utmp.o $(LIBS) $(TERMBIN) dummy: deslogin.o $(COMOBJ) termsocket.o txfr.o utmp.o $(CC) $(LDFLAGS) -o $@ deslogin.o $(COMOBJ) termsocket.o \ txfr.o utmp.o $(TERMLIBS) mv $@ $(TERMBIN) deslogind: deslogind.o $(COMOBJ) pty.o utmp.o $(NSTOBJ) defkey.o $(CC) $(LDFLAGS) -o $@ $@.o $(COMOBJ) pty.o utmp.o defkey.o \ $(NSTOBJ) $(LIBS) cat deslogind.o >defkey.o rm defkey.o deslogingw: deslogingw.o $(COMOBJ) socket.o txfr.o $(CC) $(LDFLAGS) -o $@ $@.o $(COMOBJ) socket.o txfr.o $(LIBS) deslogind.o: deslogind.c $(SERHDR) $(DESHDR) $(CC) $(LOGINDFLAGS) $(CFLAGS) -c deslogind.c deslogingw.o: deslogingw.c $(SERHDR) $(DESHDR) $(CC) $(GWFLAGS) $(CFLAGS) -c deslogingw.c deslogin.o: deslogin.c $(CLIHDR) $(DESHDR) $(CC) $(CFLAGS) -c deslogin.c cipher: $(DESBINOBJ) $(DESOBJ) $(CC) $(LDFLAGS) -o $@ $(DESBINOBJ) $(DESOBJ) gendeskd: gendeskd.o getkey.o $(DESOBJ) $(CC) $(LDFLAGS) -o $@ $@.o getkey.o $(DESOBJ) defkey.o: defkey.c $(CC) $(CFLAGS) -c defkey.c cat deslogin.h >defkey.c rm defkey.c # Force symlinks to be created before attempting to compile $(DESOBJ) cipher.h: links defkey.c: gendeskd @if [ ! -f keymsg-ok ]; then cat keymsg; touch keymsg-ok; fi @./gendeskd > $@.tmp @mv $@.tmp $@ socket.o: socket.c $(CC) $(NSTCFLAGS) -c socket.c termsocket.o: termsocket.c $(CC) $(NSTCFLAGS) $(TERMDEFINES) -c termsocket.c termsocket.c: socket.c rm -f $@ ln socket.c $@ txfr.o: txfr.c $(CC) $(NSTCFLAGS) -c txfr.c group.o: group.c $(CC) $(NSTCFLAGS) -c group.c getkey.o: getkey.c $(CC) $(NSTCFLAGS) -c getkey.c log.o: log.c $(CC) $(NSTCFLAGS) -c log.c tty.o: tty.c $(CC) $(NSTCFLAGS) -c tty.c man: $(MANSRC) nroff -man <$(MANSRC) # No changes needed below here install: # $(BINS) $(MANSRC) @echo @echo You must install by hand. Running automatic installation @echo scripts \(especially as root\) is extremely dangerous. @echo @echo It's more secure if $(BINS) are @echo stripped, linked statically, and not readable or writeable by @echo users other than owner. They should *NOT* be setuid but @echo they can and should be executable by anyone. @echo @echo The following two commands should work: @echo " strip $(BINS) @echo " chmod 111 $(BINS)" @echo @echo --- For system-wide installations --- @echo Deslogind should be owned by root. @echo Add to /etc/services: @echo " deslogin 3005/tcp" @echo " deslogingw 3006/tcp" @echo Add to /etc/inetd.conf: @echo " deslogin stream tcp nowait root $(BINDIR)/deslogind deslogind -c" @echo " deslogingw stream tcp nowait root $(BINDIR)/deslogingw deslogingw -c" @echo Make sure $(USER_FILE) exists. @echo " If you use deslogind with -c, make sure the file is encrypted" @echo with cipher using the same passphrase you specifed when building @echo deslogind. See the deslogind man page for details. @echo @echo Install the executables with the following commands: @echo " cp $(BINS) $$(BINDIR)" @echo " cp $(MANSRC) $(MANDIR)" @echo links: $(DESDIR) if [ ! -f "$(DESDIR)/des.h" ]; then \ echo get cipher source code and install in $(DESDIR); \ exit 1; \ else \ for i in $(DESSRC) $(DESBINSRC) $(DESHDR); do \ if [ ! -r $$i ]; then ln -s $(DESDIR)/$$i .; fi; \ done \ fi touch links cleanlinks: $(DESDIR) for i in $(DESSRC) $(DESBINSRC) $(DESHDR); do \ if [ -r $$i ]; then rm -f $$i; fi; \ done rm termsocket.c rm -f links $(DIST).tar: $(SRC) tar -cvhf - $(SRC) >$(DIST).tar tar: $(DIST).tar touch tar tar.Z: tar compress <$(DIST).tar >$(DIST).tar.Z tar.gz: tar gzip <$(DIST).tar >$(DIST).tar.gz dist: tar @set -x; \ VERS=`grep version deslogind.c | \ sed -e 's/^.*version \([0-9.]\{1,3\}\).*$$/\1/'`; \ NAME=$(DIST)-$${VERS}; \ echo "$${NAME}"; \ if [ -d "$${NAME}" ]; then \ rm -f $${NAME}/*; rmdir $${NAME}; \ fi; \ mkdir $${NAME}; \ cd $${NAME}; \ tar -xf ../$(DIST).tar; \ cd ..; \ tar -cf - $${NAME} | gzip >$${NAME}.tar.gz; touch dist shar: $(SRC) shar $(SRC) >$(DIST).shar btoa: tar btoa <$(DIST).tar.Z >$(DIST).btoa clean: rm -f $(OBJS) termsocket.o defkey.c keymsg-ok $(BINS) clobber: clean cleanlinks ogind.c | \ sed -e 's/^.*version \([0-9.]\{1,3\}\).*$$/\1/'`; \ NAME=$(DIST)-$${VERS}; \ echo "$${NAME}"; \ if [ -d "$${NAME}" ]; then \ rm -f $${NAME}/*; rmdir $${NAME}; \ fi; \ mkdir $${NAME}; \ deslogin-1.3/deslogind.users000044400001450000013000000010420556552044300172540ustar00barrettsystem00000000000000# # Netlogind user database # # Whitespace separated list of username/passphrase pairs. # Note that whitespace may appear in the passphrase so it's last. # The empty passphrase is allowed # Ascii values greater than 127 are illegal. # # For added security, this file may be encrypted with the cipher program # and the same key given to netlogind when it's invoked interactively. # In any case, make sure that it's not readable by other than root and the # netlogind program's owner (group). # martha martha's passphrase john simple, but secure itespace separated list of username/passphrase pairs. # Note that whitespace may appear in the passphrase so it's last. # The empty passphrase is allowed # Ascii values greater than 127 are illegal. # # For added security, this file may be encrypted with the cipher program # and the same key given to netlogind when it's invoked interactively. # In any case, make sure that it's not readable by other than root and the # netlogind program's owner (group). # martha martha's padeslogin-1.3/Notes000064400001450000013000000265040560371630000152400ustar00barrettsystem00000000000000Notes on bi-directional simultanious I/O: (from barrett@asgard.cs.colorado.edu) Problems Discussed: - How do you prevent a write from blocking when select(2) returns true? - How do you detect when the slave side of the pty closes (logout) ? - How do you prevent the deamon from creating zombie processes ? - Portability Notes Porting Notes: A strong attempt has been made to use POSIX compatable functions as much as possible. Obviously, POSIX does not define everything, so here is what is non-posix: utmp.c: Contains the most machine specific code. The only function it exports is setlogin, which is used to update the /etc/utmp file used by the getlogin library call and the who program (finger) and the like. You can delete the call to setlogin in netlogind.c if this file causes problems. tty.c: the constant ONLCR is needed to set the tty into the right "cooked" state for the remote shell. This shouln't be a problem, but you may need to play around with the #define _POSIX_SOURCE and the include file order. The rest is completly POSIX! Amazing! The files "txfr.c", "socket.c", "pty.c" all will have BSD-style calls there. The reason is that POSIX doesn't have these OS calls required for networking. txfr.c: Makes extensive use of select. There are comments in the file if you find the data gets constipated or the program aborts with read or write failure. socket.c: Contains all the BSD socket style calls. Should work on any BSD style networking system. pty.c: It appears that pty's should work on both BSD and system V. This code shouldn't cause any problems. Anything else should port straight away. If you have problems, the code has been designed to be easily debuggable. If you set the run-time option "-d", the program will not do a fork when the "accept" socket call completes. This should allow you to examine almost anythnig you wish. Typically the "-l" and "-p" and "-f" options are very helpful here. You don't have to run the program as root. If you are using gcc on the decstations or sparcs: The decstations have a problem compiling psignal.c with gcc. Use the dec compiler. The sun sparc machines define the memcmp stuff in . This is non-standard. I discovered this only when compiling with gcc -Wall. The sun compiler silently compiles everything fine. Both machines report a lot of implicitly defined functions. I don't know why the headers for gcc can't do this. Let me know if you find a fix. Dectecting Close on Slave Side of Pty (for netlogind): We need a way to tell from the master side, if the slave side of the pty has been closed. The BSD pty man page doesn't say. The HP-UX man pages states "...exceptional condition refers to an open(2), close(2), or ioctl(2) request pending on the slave side...". But, this only will occur if TIOCTRAP is enabled on the master pty pty(7). HP's pty TIOCTRAP is an hp-only feature. No such features exist on BSD, although it may be that setting the baudrate on the slave side to B0 will cause the master to see it--I can't count on this because the shell doesn't appear to do this on exit. Thus, SIGCHLD will have to be used. Note that System V's SIGCLD is NOT the same as POSIX's SIGCHLD. One problem is that SIGCHLD isn't triggered in POSIX if sysconf(_SC_JOB_CONTROL) is zero. The select statement in netlogind will not abort if the child shell dies and SIGCHLD is not caught. The solution appears to be just to assume that System V is being used if job control is not defined, and that SIGCLD(sic) will then be triggered. Note that SIGCHLD will still be defined, it just need not be triggered when a used on a non-job control system. Thus, for system V, there appears to be no way to force a select on the master side of a pty to detect a close on the slave side. As for daemons causing zombie processes, it appears to be impossible to stop on a POSIX system with no job control, but it CAN be solved on a System V system without job-control by setting SIGCLD to SIG_IGN before forking. Athother $64,000 question is can select ensure that no blocks will occur for read and write to sockets and ptys. Four independent questions must be answered: read/tty, read/sock, write/tty, write/sock for *blocking* descriptors! The answer to all questions is YES for non-blocking descriptors. Does a write block if there isn't enough room in a blocking fd? The answer is apparently yes, but no implication is made about atomic writes except for send(2) implies that atomic writes are used for it. The result? Use FNDELAY and on BSD select I/O (or O_NONBLOCK on POSIX). There is a "solution" to the above. Attempt to use POSIX semantics of O_NONBLOCK with select. POSIX states that writes are atomic if smaller than PIPE_BUF. For larger sizes, write may return a partial write, or -1 errno EAGAIN. This is another serious problem. If it happens, then select for write will immediately return true and the write will continue to return EAGAIN until the buffer flushes to a small enough value to succeeed. We will be sucking the CPU dry on systems which do this. The only "solution" is to have the select "poll" by inserting a delay (say 100ms) after the write returns eagain. The idea would be to insert a select for all events except the one which returned EAGAIN with a 100ms delay, which would be invoked wwhen EAGAIN occurred. After that select finished, just return to the main select loop. This would still allow other events to be processed immediately, and would limit the CPU interrupts to 10 / sec at the cost of adding upto a 100ms propagation delay into the write for that descriptor. I have chosen to assume that EAGAIN will never happen, and let the program abort if it does. That way, if this code is ported to a machine which has the above "feature", you will find out real quickly and can implement the above "solution". Another problem has to do with SOCK_STREAM sockets. Is there a propagation delay for keystrokes sent for example? TCP_NODELAY documented in TCP(4P) talks about his. Here is the related information from BSD: - read calls return as much data as possible [PS1:6-25] - nonblocking io (FNDELAY) applies ONLY to ttys and sockets [fcntl(2)-2] - Non-blocking sockets and tty fd's are created with the FNDELAY fcntl flag. [PS1:8-25] [tty(4)-2] - Writes to non-blocking sockets or to a terminal will write as much as possible. If no bytes are writable, EWOULDBLOCK is returned. [PS1:8-25] [PS1:6-19] - A recv from a non-blocking socket will return EWOULDBLOCK if no input is available. [recv(2)-1] - Reads to a non-blocking control terminal return EWOULDBLOCK if no input is available. Partial reads will succeed return the number of bytes available [tty(4)-2] [PS1:6-19]. - Select returns true when an input or output may be achieved without blocking. [PS1:6-19] - an accept will block unless non-blocking io is enabled. [PS1:6-34] PS1:8-25: 5.2 Non-blocking Sockets fcntl(sock, F_SETFL, FNDELAY) accept connect send recv read write, all will return -1 and EWOULDBLOCK. "If an operation such as send cannot be done in its entirety, but partial writes are sensible (for example, when using a stream socket), the data that can be sent immediately will be processed, and the return amount will indicate the amount actually sent." PS1:6-13: Signals A process can request notification via a SIGIO signal when input or output is possible on a descriptor, or when a non-blocking operation completes. PS1:6-19: Select - A descriptor selects for input in an input oriented operation such as read or receive is possible, or if a connection request may be accepted (see section 2.3.1.4) (2.3.1.4) Accepting Connections: ...the [accept] call will wait unless non-blocking I/O has been enabled. - A descriptor selects for output in an output oriented operation such as write or send is possible, or if an operation that was "in progress", such as connection establishment, has completed (see section 2.1.3). (2.1.3): A process that wishes to do non-blocking operations on one of its descriptors sets the descriptor in a non-blocking mode as descripbed in section 1.5.4. Thereafter, the read call will return a specific EWOULDBLOCK error indication if there is no data to be read. The process may select the associated descriptor to determine when a read is possible. Output attempted when a descriptor can accept less than is requested wil either accept some of the provided data, returning a shorter than normal length, or return an error indicating that the operation would block. More output can be performed as soon as a select call indicates the object is writable. Operations other than data input or output may be performed on a descriptor in a non-blocking fashion. These operations will return with a characteristic error indicating that they are in progress if they cannot complete immediately. The descriptor may then be serected for wwrite to find out when the operatin has been completed. When select indicates the descriptor is writable, the operation has completed. Depending on the nature of the descriptor and the operation, additional activity may be started or the new state may be tested. - A descriptor selects for an exceptional condition if a condition that would cause a SIGURG signal to be generated exists (see section 1.3.2), or other device-specific events have occurred. Operations on non-blocking descriptors will either complete immediately, note an error EWOULDBLOCK, partially complete an input or output operation returning a partial count, or return an error EINPROGRESS noting that the requested operation is in progress. A descriptor which has signalling enabled will cause the specified process and/or process group to be signalled, with a SIGIO for input, output, or in-progress operation complete, or a SIGURG for exceptional conditions. For example, when writing to a terminal using non-blocking output, the system will accept only as much data as there is buffer space for and return; when making a connection on a socket, the operation may return indicating that the connection establishment is "in progress". The select facility can be used to determine when further output is possible on the terminal, or when the connection establishment attempt is complete. recv(2)-1: "The select(2) call may be used to determine when more data arrives." write(2)-1: When using non-blocking I/O on objects such as sockets that are subject to flow control, write and writev may write fewer bytes than requested. fcntl(2)-1: FNDELAY Non-blocking I/O: if no data is available to a read call, or if a write operation would block, the call returns -1 with the error EWOULDBLOCK. fcntl(2)-2: BUGS: The asychronous I/O facilities of FNDELAY and FASYNC are currently available only for tty and socket operations. --- 27-Jun-94 --- Received man pages and include files for attempt to port to UNICOS on the Cray, and Solaris OS and IRIX. IRIX and Solaris can't deal with ut_host in utmp.c. IRIX and UNICOS can't open the pty: "no pty's available". Solaris reports: could not acquire fd 0 (/dev/ttyp0) as controlling terminal--Inappropriate ioctl for device" he error EWOULDBLOCK. fcntl(2)-2: BUGS: The asychronous I/O facilities of FNDELAY and FASYNC are currently available only for tty and socket operations. --- 27-Jun-94 --- Receivedeslogin-1.3/keymsg000064400001450000013000000017240560457623200154550ustar00barrettsystem00000000000000 You must select a default encryption key for the userFile. This allows you to place "deslogind -c" in /etc/inetd.config. Pick a secure passphase, longer than 8 characters, that you can remember. You will need it every time you must edit the userFile (to add users, or to change pass phrases). The most secure way to run deslogind is with no arguments and type the userFile passphrase in response to its query. You need never use the -c option, and when you do, it never exposes the contents of the userFile. If you use a different key to encrypt the userfile, the -c option will not work, but otherwise the deslogind will work fine. The compiled-in key is not stored as a text string, nor is it a simple 8-byte DES key. *** Do not run deslogind where its virtual-memory data segment *** can be examined by sufficiently determined hostile users. *** Do not use the -c option if the executable file can be *** can be examined by sufficiently determined hostile users. it never exposes the contents of the userFideslogin-1.3/posignal.h000044400001450000013000000022470556576334000162230ustar00barrettsystem00000000000000#ifndef _PSIGNAL_H /* { */ #define _PSIGNAL_H /* * The type of a signal handler is declared inconsistantly in the header files. * Extremely picky compilers may require adjustment here; most don't complain. * The problem is what the type of signal's argument really is. POSIX doesn't * state this precisely; what is the prototype of the signal handler's * declaration supposed to look like exactly? Like Sun, I would guess * void handler(int,...) * but most vendors use void handler(). * * Note: The HP-UX C++ compiler doesn't consider a typedef type compatable * with an explicitly declared type that's the same. Gnu g++ can't * handle old style argument declaractions in function definitions. */ #if defined(__STDC__) || defined(__cplusplus) /* { */ #if (defined(_HPUX_SOURCE) && defined(__cplusplus)) || defined(linux) /* { */ typedef void (*pfv)(int); #else /* } { */ typedef void (*pfv)(); /* POSIX (normal case) */ #if 0 typedef void (*pfv)(int, ...); /* sunOS 4.1.2 C++ */ #endif #endif /* } !int arg*/ extern pfv posignal(int, pfv); #else /* } { !STDC */ typedef void (*pfv)(); extern pfv posignal(); #endif /* } !STDC */ #endif /* } */ e argument declaractions in function definitions. */ #if defined(__STDC__) || defined(__cplusplus) /* { */ #if (defined(_HPUX_SOURCE) && defined(__cplusplus)) || defined(linux) /* { */ typedef void (*pfv)(int); #else /* } { */ typedef void (*pfv)(); /* POSIX (normal case) */ #if 0 typedef void (*pfv)(int, ...); /* sunOS 4.1.2 C++ */ #endeslogin-1.3/tty.h000044400001450000013000000010050556552042700152130ustar00barrettsystem00000000000000#ifndef _TTY_H #define _TTY_H #if defined(__STDC__) || defined(__cplusplus) int isTty(int fd); int openCtty(void); int restoreTty(int ttyfd, struct termios *oldmodes); int setTtyBin(int ttyfd, struct termios *oldmodes); int setTtyAscii(int ctty); int setTtyEcho(int ttyfd, int echo); int mkCtrlTty(int ttyfd, int flag); int askTty(char *, char *, unsigned, int); #else int isTty(); int openCtty(); int restoreTty(); int setTtyBin(); int setTtyAscii(); int setTtyEcho(); int mkCtrlTty(); int askTty(); #endif #endif ef _TTY_H #define _TTY_H #if defined(__STDC__) || defined(__cplusplus) int isTty(int fd); int openCtty(void); int restoreTty(int ttyfd, struct termios *oldmodes); int setTtyBin(int ttyfd, struct termios *oldmodes); int setTtyAscii(int ctty); int setTtyEcho(int ttyfd, int echo); int mkCtrlTty(int ttyfd, int flag); int askTty(char *, char *, unsigned, int); #else int isTty(); int openCtty(); int restoreTty(); int setTtyBin(); int setTtyAscii(); int setTtyEcho(); int mkCtrlTty(); int askTty(); #endif #edeslogin-1.3/auth.h000044400001450000013000000015770556552042700153520ustar00barrettsystem00000000000000#ifndef _AUTH_H #define _AUTH_H #include "des.h" /* keyType exported from des.h */ #define destroyKey desDestroyKey typedef void *cipherKey; #if defined(__STDC__) || defined(__cplusplus) extern keyType challenge(int fd, char *keyString, unsigned timeout); extern keyType signature(int fd, char *keyString, unsigned timeout); extern keyType mkKey(char *keyString); /* create CFB key */ extern cipherKey mkCipherKey(keyType key, int mode); extern void cipherData(char *dst, char *src, unsigned size, cipherKey c); extern void destroyCipherKey(cipherKey *c); extern int getUserPhrase( char *fname, char *phrase, unsigned size, char *uname, keyType key); #else extern keyType challenge(); extern keyType signature(); extern keyType mkKey(); extern cipherKey mkCipherKey(); extern void cipherData(); extern void destroyCipherKey(); extern int getUserPhrase(); #endif #endif e CFB key */ extern cipherKey mkCipherKey(keyType key, int mode); extern void cipherData(char *dst, char *src, unsigned size, cideslogin-1.3/txfr.h000044400001450000013000000013030555105763300153560ustar00barrettsystem00000000000000#ifndef _TXFR_H #define _TXFR_H #if defined(__STDC__) || defined(__cplusplus) extern int txfr(int fd1, int fdin, int fdout, unsigned bufsize, unsigned timeout, keyType key); extern int getString(int fd, char *buf, unsigned size, unsigned timeout); extern int getBlock(int fd, char *buf, unsigned size, unsigned timeout); extern int cipherCopy(int dstfd, int srcfd, unsigned timeoutSec, keyType key); extern int waitReady(int fd, char *buf, unsigned size, unsigned timeout); extern int mkReady(int fd, char *buf, unsigned size, unsigned timeout); #else extern int txfr(); extern int getString(); extern int getBlock(); extern int cipherCopy(); extern int waitReady(); extern int mkReady(); #endif #endif ing(int fd, char *buf, unsigned size, unsigned timeout); extern int getBlock(int fd, char *buf, unsigned size, unsigned timeout); extern int cipherCopy(int dstfd, int srcfd, unsigned timeoutSec, keyType key); extern int waitReady(int fd, char *buf, unsigned size, unsigned timeout); extern int mkReady(int fd, char *bdeslogin-1.3/socket.h000044400001450000013000000012700556552042700156670ustar00barrettsystem00000000000000#ifndef _SOCKET_H #define SOCKET_H #if defined(__STDC__) || defined(__cplusplus) extern int openClient(char *hostName, int port); extern int openServer(int port, char *hostName, unsigned size, unsigned *rport, int serverflag); extern int getRemoteAddr(int sock, char *hostName, unsigned size, unsigned *port); extern int getLocalAddr(int sock, char *hostName, unsigned size, unsigned *port); extern int getServicePort(char *name); extern int socktype(int fd); #else extern int openServer(); extern int openClient(); extern int getRemoteAddr(); extern int getLocalAddr(); extern int getServerPort(); extern int socktype(); #endif #define issocket(fd) socktype(fd) #endif ed size, unsigned *rport, int serverflag); extern int getRemoteAddr(int sock, char *hostName, unsigned size, unsigned *port); extern int getLocalAddr(int sock, char *hostName, unsigned size, unsigned *port); extern int getServicePort(char *name); extern int socktype(int fd); #else extern int openServerdeslogin-1.3/log.h000044400001450000013000000010330572743274500151620ustar00barrettsystem00000000000000#ifndef _LOG_H #define _LOG_H #if !defined(ERRMSG) /* { */ #if (!defined(sparc) && !defined(sun3)) || defined(__SOLARIS__) /* { ANSI */ #define ERRMSG strerror(errno) #else /* } { strerror missing on SunOS 4.1.3_U1 */ #define ERRMSG sys_errlist[errno] extern char *sys_errlist[]; #endif /* } */ #endif /* } */ #if defined(__STDC__) || defined(__cplusplus) extern void log(char *, ...); extern int openLog(char *fname); extern void closeLog(void); #else extern void log(); extern int openLog(); extern void closeLog(); #endif #endif _H #if !defined(ERRMSG) /* { */ #if (!defined(sparc) && !defined(sun3)) || defined(__SOLARIS__) /* { ANSI */ #define ERRMSG strerror(errno) #else /* } { strerror missing on SunOS 4.1.3_U1 */ #define ERRMSG sys_errlist[errno] extern char *sys_errlist[]; #endif /* } */ #endif /* } */ #if defined(__STDC__) || defined(__cplusplus) extern void log(char *, ...); extern int openLog(char *fname); extern void closeLog(void); #else extern void log(); extern int openLog(); extern voiddeslogin-1.3/deslogin.h000044400001450000013000000044550572743274600162210ustar00barrettsystem00000000000000#ifndef _DESLOGIN_H #define _DESLOGIN_H /* * The protocol version is sent by the daemon, and used by the client to * ensure that the correct handshaking is performed. This allows the * protocol to be extened in the future. */ #define PROTOCOL_VERS "1.00" /* version of protcol */ #define VERS_SIZE 16 /* max chars of version string + 1 */ #ifndef SETUP_TIMEOUT #define SETUP_TIMEOUT 30000 /* ms for login sequence handshakes */ #endif #ifndef LOGIN_TIMEOUT #define LOGIN_TIMEOUT 30 /* login timeout (sec) */ #endif #ifndef INACTIVITY_TIMEOUT #define INACTIVITY_TIMEOUT 1200 /* inactivity timeout (sec) */ #endif /* Should be short for security */ #ifndef DESLOGIN_PORT #define DESLOGIN_PORT 3005 /* port for /etc/services */ #endif #ifndef DESLOGIN_GW_PORT #define DESLOGIN_GW_PORT 3006 /* default gateway for deslogingw */ #endif #ifndef SERVICE_NAME #define SERVICE_NAME "deslogin" /* default name for /etc/services */ #endif #ifndef GW_SERVICE_NAME #define GW_SERVICE_NAME "deslogingw" #endif #ifndef LOGIN_PROG /* * Login is in /bin on most machines I can find. * (SunOs 4.1, DEC OSF1, DEC MIPS, HP-UX) */ #define LOGIN_PROG "/bin/login" /* login program for -w opt */ #endif #define PHRASE_SIZE 255 /* maximum length of a passphrase+1 */ #if !defined(ERRMSG) /* { */ #if (!defined(sparc) && !defined(sun3)) || defined(__SOLARIS__) /* { ANSI */ #define ERRMSG strerror(errno) #else /* } { strerror missing on SunOS 4.1.3_U1 */ #define ERRMSG sys_errlist[errno] extern char *sys_errlist[]; #endif /* } */ #endif /* } */ extern int errno; extern char *progName; extern int debug; extern int verbose; #if defined(__STDC__) || defined(__cplusplus) /* * Defined in but only if _AES_SOURCE is #defined, which * requires _XOPEN_SOURCE also. I don't want to import other symbols. */ #if defined(__cplusplus) extern "C" { #endif #if 0 #ifndef __GNUC__ /* gnu declares getopt in stdlib.h with no const */ int getopt(int, char * const [], const char *); #endif #endif #if defined(__cplusplus) } #endif #else extern int getopt(); #endif #if (defined(sparc) || defined(sun3)) && !defined(__SOLARIS__) /* * Unfortunately, the SunOS 4.1.1 does not have atexit. This is a kludge to * provide that functionality on the suns using a sun-specific library call. */ #define atexit on_exit #endif #endif if defined(__cplusplus) extern "C" { #endif #if 0 #ifndef __GNUC__ /* gnu declares getopt in stdlib.h with no const */ int getopt(int, char * const [], const char *); #endif #endif #if defined(__cplusplus) } #endeslogin-1.3/utmp.h000044400001450000013000000033620572541740300153650ustar00barrettsystem00000000000000#if !defined(_utmp_deslogind_h) /* sparc defines _utmp_h */ #define _utmp_deslogind_h /* * Sun's Solaris has two types of utmp/wtmp file: * 1) /var/adm/utmp.h /var/adm/wtmp.h - based on * 2) /var/adm/utmpx.h /var/adm/wtmpx.h - based upon * * There is a problem with each: * 1) there is no remote host entry in struct utmp. * 2) if utmpx is updated, utmp must be also or it isn't visible. * * This code will uses solution 1 above, which works on solaris too. * If you want solution 2 instead, add -DUTMPX to the cc command. */ #if defined(UTMPX) /* { */ /* utmpx.h requires (struct timeval) */ #include /* UTMPX_FILE (struct utmpx) */ #else /* } { */ #include /* UTMP_FILE WTMP_FILE (struct utmp) */ #endif /* } */ /* * Get the name of the utmp and wtmp files from anywhere you can. * Precedence is from CCFLAGS, , hardwired * Don't use a symbol that conflicts with previous definitions. */ #if defined(_PATH_UTMP) /* { from CCFLAGS */ #undef UTMP_FILE /* previously defined in */ #define UTMP_FILE _PATH_UTMP #endif /* } */ #if !defined(UTMP_FILE) /* { */ #define UTMP_FILE "/etc/utmp" /* also /var/adm/utmp */ #endif /* } */ #if defined(_PATH_WTMP) /* { from CCFLAGS */ #undef WTMP_FILE /* previously defined in */ #define WTMP_FILE _PATH_WTMP #endif /* } */ #if !defined(WTMP_FILE) /* { */ #define WTMP_FILE "/etc/wtmp" /* also /var/adm/wtmp */ #endif /* } */ #if defined(__STDC__) || defined(__cplusplus) extern int setlogin( char *ttydevicepath, char *username, char *rhost, int *exitstatloc); extern char *getLoginName(void); #else extern int setlogin(); extern char *getLoginName(); /* A non-utmp dependent getlogin() */ #endif #endif /* { from CCFLAGS */ #undef WTMP_FILE /* previously defined in */ #define WTMP_FILE _PATH_WTMP #endif /* } */ #if !defined(WTMP_FILE) /* { */ #define WTMP_FILE "/etc/wtmp" /* also /var/adm/wtmp */ #endif /* } */ #if defined(__STDC__) || defined(__cpluspldeslogin-1.3/pty.h000044400001450000013000000004330571160500400151770ustar00barrettsystem00000000000000#define PTY_NAMESIZE 16 #if defined(__STDC__) || defined(__cplusplus) extern int openSlavePty(char *slaveName, int mode); extern int openPty(int mode, char *slaveName, char *masterName, unsigned size, int *slaveFd); #else extern int openSlavePty(); extern int openPty(); #endif ÁÀrevi¬y de¬ */ÿïì Ž¬oüpqy de¬ /* close getlogin */ #include /* atexit exit */ #include #include #include #include #include /* for fcntl.h */ #include #include #include "posignal.h" #include "tty.h" #include "auth.h" #include "txfr.h" #include "socket.h" #include "deslogin.h" #include "utmp.h" extern int optind; extern char *optarg; #if defined(__STDC__) || defined(__cplusplus) extern int askTty(char *, char *, unsigned, int); #else extern int askTty(); #endif static char ident[] = " @(#) deslogin.c version 1.32 03-Mar-95 Copyright 1995 by Dave Barrett(barrett@asgard.cs.Colorado.EDU)\n"; static char RCSid[] = " @(#) deslogin.c RCS: $Revision: 1.8 $ $Date: 95/03/08 01:13:04 $\n"; char *progName; int debug = 0; int verbose = 0; char unknownLoginName[] = "unknown"; unsigned long inBytes = 0; /* for txfr */ unsigned long outBytes = 0; struct termios oldmodes; int fixfd = -1; void fixtty() { register int res; if (fixfd >= 0) { res = restoreTty(fixfd, &oldmodes); } } void handler(sig) int sig; { exit(0); /* calls fixtty via atexit */ } /* * Perform a client handshake with the server */ char *clientHandshake(nfd, string1, string2) int nfd; char *string1, *string2; { int count, res; static char protover[VERS_SIZE]; count = getString(nfd, protover, VERS_SIZE-1, SETUP_TIMEOUT); if (count == 0) { fprintf(stderr, "%s: network read of (protover) failed--%s\n", progName, ERRMSG); return 0; } res = write(nfd, PROTOCOL_VERS, strlen(PROTOCOL_VERS)+1); if (res < 0) { fprintf(stderr, "%s: gateway network write of \"%s\" failed--%s\n", progName, PROTOCOL_VERS, ERRMSG); return 0; } if (protover[0] != PROTOCOL_VERS[0]) { fprintf(stderr, "%s: remote protocol version (%s) incompatable with local (%s)\n", progName, protover, PROTOCOL_VERS); return 0; } res = write(nfd, string1, strlen(string1)+1); if (res < 0) { fprintf(stderr, "%s: gateway network write of \"%s\" failed--%s\n", progName, string1, ERRMSG); return 0; } res = write(nfd, string2, strlen(string2)+1); if (res < 0) { fprintf(stderr, "%s: gateway network write of \"%s\" failed--%s\n", progName, string2, ERRMSG); return 0; } return protover; } int main(argc, argv) int argc; char *argv[]; { int ch, count, res; unsigned bufSize = 127; char aport[16]; char *chp, *hostName = (char *) 0, *gateway = (char *) 0; char *loginName, *ruser = (char *) 0; int nfd, port = DESLOGIN_PORT, gport = 0, loginLen, userLen; char passPhrase[PHRASE_SIZE], target[128], *tp = (char *) 0; keyType key; progName = *argv; if ((chp = strrchr(progName, '/')) != (char *) 0) progName = chp + 1; while ((ch = getopt(argc, argv, "dvh:g:")) != EOF) switch (ch) { case 'h': tp = optarg; break; case 'g': gateway = optarg; break; case 'v': verbose++; break; case 'd': debug++; break; default: usage: fprintf(stderr, "usage: %s [-dvt] [-g gateway] [ [user@]domain[:port] ]\n", progName); exit(1); } argc -= optind; argv += optind; if (argc != 0) { tp = *argv++; --argc; } if (tp == (char *) 0) { res = askTty("Input destination <[user@]domain[:port]>:", target, 128-1, 1); if (res < 0) { fprintf(stderr, "%s: couldn't get destination\n", progName); exit(1); } tp = target; } chp = strchr(tp, '@'); if (chp != (char *) 0) { *chp = '\0'; ruser = tp; hostName = chp+1; } else { hostName = tp; } chp = strchr(hostName, ':'); if (chp != (char *) 0) { *chp = '\0'; count = sscanf(chp+1, "%u", &port); if (count != 1) goto usage; } sprintf(aport, "%d", port); loginName = (char *) getLoginName(); /* NOT getlogin!; see utmp.c */ if (loginName == (char *) 0) { fprintf(stderr, "%s: Warning--getLoginName failed\n", progName); loginName = unknownLoginName; } loginLen = strlen(loginName); if (ruser == (char *) 0) { ruser = loginName; if (loginName == unknownLoginName) { fprintf(stderr, "%s: unknown local login name; must specify remote user\n", progName); exit(1); } } userLen = strlen(ruser); if (gateway != (char *) 0) { chp = strchr(gateway, ':'); if (chp != (char *) 0) { *chp = '\0'; count = sscanf(chp+1, "%u", &gport); if (count != 1) goto usage; } if (gport == 0) { gport = getServicePort(GW_SERVICE_NAME); if ((int) gport < 0) { gport = DESLOGIN_GW_PORT; } } nfd = openClient(gateway, gport); if (nfd < 0) { fprintf(stderr, "%s: open gateway %s:%d failed --%s\n", progName, gateway, gport, ERRMSG); exit(1); } res = askTty("Gateway Pass phrase: ", passPhrase, PHRASE_SIZE-1, 0); if (res < 0) { fprintf(stderr, "%s: couldn't get pass phrase\n", progName); exit(1); } key = signature(nfd, passPhrase, SETUP_TIMEOUT); memset(passPhrase, '\0', PHRASE_SIZE); destroyKey(&key); chp = clientHandshake(nfd, hostName, aport); if (!chp) { exit(1); } } else { nfd = openClient(hostName, port); if (nfd < 0) { exit(1); } } chp = clientHandshake(nfd, loginName, ruser); if (!chp) { exit(1); } res = askTty("Pass phrase: ", passPhrase, PHRASE_SIZE-1, 0); if (res < 0) { fprintf(stderr, "%s: couldn't get pass phrase\n", progName); exit(1); } key = signature(nfd, passPhrase, SETUP_TIMEOUT); memset(passPhrase, '\0', PHRASE_SIZE); /* * If unsuccessful, the remote side will shut down the connection which * will cause the rest of the program to exit * * There is a strange interaction between two fd's associated with the * same device. They will share the same modes. Thus, only one of * these modes must be saved or restored. */ if (isTty(0)) { fixfd = 0; } else if (isTty(1)) { fixfd = 1; } if (fixfd >= 0) { res = setTtyBin(fixfd, &oldmodes); if (res < 0) { fprintf(stderr, "%s: setTtyBin failed to fd %d--%s\n", progName, fixfd, ERRMSG); exit(1); } res = atexit(fixtty); if (res == -1) { fprintf(stderr, "%s: atexit failed--%s\n", progName, ERRMSG); exit(1); } } chp = (char *) posignal(SIGINT, handler); if (chp == (char *) -1L) { fprintf(stderr, "%s: sigaction failed--%s\n", progName, ERRMSG); exit(1); } res = txfr(nfd, 0, 1, bufSize, 0, key); destroyKey(&key); if (isTty(1)) { write(1, "\r\nConnection closed.\r\n", 22); } exit(0); /* to ensure that atexit is called */ return 0; } res = atexit(fixtty); if (res == -1) { fprintf(stderr, "%s: atexit failedeslogin-1.3/deslogind.c000044400001450000013000001455500572742220700163510ustar00barrettsystem00000000000000/* * Copyright 1994 David A. Barrett. * * Remote login deaemon with authentication and data encryption of channel * * Revision History: * * 12-May-94: Fixed two malloc bugs in gendeskd.c and deslogind.c. * 14-Jun-94: * deslogind.c: Added -w option for login wrapper feature * -w option busted on HP-UX; wait for help. * Added RHOSTNAME environment variable. * utmp.c: added update of wtmp to writeut * log.c: ifdef'd return result from openlog * socket.c: errno.h inside #undef posix for ENOTSOCK (BSD/386) * tty.c: added control terminal setting for BSD/386 * changed "psignal" to "posignal" to avoid BSD name conflict * added changes for BSDI BSD/386 * changed include before for BSD/386 * Thanks to Tom Markson for BSD/386 changes. * 24-Jan-95: Added WRITE_RETRY_TIME to txfr.c to fix linux lost connections * * Still to do: * Make the -w option work for HP-UX * Add '.' notation to hostname stuff on socket.c to allow IP addr to be used * figure out a way to run commands and pipelines: * it requires a way to make sure the pipes are flushed before exit * it may require detection of EOF across network * Add ip address to utmp entry for system V. fix in socket.c. * On hpux, can't reuse port numbers for a short while after exit. Why? * Check permissions on deslogin.users, and deslogin.log; issue warning. * Encrypt the log files too. * Catch all Coredump signals to prevent hostile user from signaling * us and examining the carcass for keys (deslogind, deslogingw). * How do you prevent a debugger from doing a ptrace(PT_ATTACH)? (cant!) * Compression (tricky because you must not impose delays) * Allow socket to be connected directly to resulting process * (won't happen because the parent is needed to encipher the data stream) * Figure out a way to improve protection from local users: * X11 server DISPLAY variable: * :0 still doesn't help because that creates a unix-domain socket: * named /usr/spool/sockets/X11/0 * * Deslogin: * Make sure that getPassphrase is not reading from unsecure device: * check $DISPLAY envt for 'local:' or ':' as prefix * check utmp to make sure not rlogin from somewhere else * permissions on Ctermid? Trojan Ctermid? * Protect against trojan of deslogin itself. * * Enhancements: * See rshd man page for internet socket login protocol. * Secondary socket for stderr ASCII port # '\0' terminated 0=none * upto 16 character server user name '\0' terminated * upto 16 character client user name '\0' terminated * command to execute limited by system's argument list * Server authenticates channel and sends a null byte to stderr sock * errors are sent with a '\1' as leading byte with mesage. * Notice that hpux rlogind man page describes a different protocol also. * Add passphrase command * * Inetd notes: * Umask and uid inherited from init and envt * Socket is available as stdin and stdout * * Notes: * I have set posignal so that SIGSTOP will not cause SIGCHLD. This allows * you to STOP a potential intruder in his tracks by sending SIGSTOP to * the process and then attach a debugger to it and examine what is going * on. * * Comments which Give a Section number and line number correspond to * quotes from IEEE Std 1003.1-1990 (ISO/IEC 9945-1: 1990). * (E.g. Sect5:10-12 means Section 5 lines 10 through 12 inclusive) */ #define _POSIX_SOURCE /* * This is a mess. HP-UX ANSI C won't define pid_t in unless * _POSIX_SOURCE is defined. Other machines may refuse to define it. Pick * what's appropriate. uses pid_t. On __SOLARIS__, * uses (struct timeval) which won't be defined unless !_POSIX_SOURCE. */ #if defined(__SOLARIS__) /* { */ #undef _POSIX_SOURCE /* allows struct timeval to be defined */ #undef _POSIX_C_SOURCE #include /* gid_t pid_t uid_t clock_t */ #include /* time (also needed for "utmp.h") */ #define _POSIX_SOURCE #define _POSIX_C_SOURCE #else /* } { */ #include /* gid_t pid_t uid_t clock_t */ #include /* time (also needed for "utmp.h") */ #endif /* } */ #include /* struct tms */ /* mips fails to define prototype for times() unless */ /* __POSIX is defined. Strange. */ #include /* chdir close dup execve fork */ /* getlogin getpid getppid getpgrp */ /* setsid setgid setpgid setuid ctermid */ /* _SC_NGROUPS_MAX */ #include /* NGROUPS_MAX */ #include /* must be before stdlib.h for BSDI's BSD 386 */ #include /* atexit exit free malloc */ #include /* (fopen fclose fgets scanf printf etc.) */ #include /* memcmp memcpy memset */ #include #include /* umask flags */ #include #include #include #include #include /* WNOHANG */ #include "pty.h" #include "tty.h" #include "auth.h" #include "txfr.h" #include "socket.h" #include "log.h" #include "deslogin.h" #include "posignal.h" #include "utmp.h" /* setlogin */ #include "group.h" /* getLoginGroups */ #if defined(sun) #define BSD #endif #if defined(mips) #define BSD #endif /* * Begin customizable area */ #if !defined(DEFAULT_UMASK) /* login user mask */ #define DEFAULT_UMASK S_IWGRP|S_IWOTH #endif #if !defined(TTY_MODE) /* login permissions for controlling terminal */ #define TTY_MODE (S_IRUSR|S_IWUSR|S_IWGRP|S_IWOTH) #endif #define TTY_RWANY (S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH) /* * These environment variables may be overwridden in the makefile */ #if defined(BSD) /* sun dec mips */ #if !defined(USERPATH) #define USERPATH ":/usr/ucb:/bin:/usr/bin" #endif #if !defined(SYSTEMPATH) #define SYSTEMPATH "/etc:/usr/ucb:/bin:/usr/bin" #endif #endif #if defined(hpux) /* hpux only */ #define DEFAULT_MAIL "/usr/mail/" #endif #if !defined(USER_ENV) /* Additional envt variable to store userName */ #define USER_ENV "USER" /* BSD (sun dec mips) xdm (not hpux) */ #endif #if !defined(USERPATH) #define USERPATH ":/bin:/usr/bin" #endif #if !defined(SYSTEMPATH) #define SYSTEMPATH "/etc:/bin:/usr/bin" #endif #if !defined(DEFAULT_TERM) #define DEFAULT_TERM "network" #endif #if !defined(USER_FILE) #define USER_FILE "/usr/local/etc/deslogind.users" #endif #if !defined(NOLOGIN_FILE) #define NOLOGIN_FILE "/etc/nologin" #endif #if !defined(LOG_FILE) #define LOG_FILE "/usr/adm/deslogind.log" #endif /* * End of customizable area */ #define PROGNAME_SIZE 255 #define USERNAME_SIZE 17 /* assumption based on rshd man page */ #define MAX_HOSTNAME 255 extern int optind; extern char *optarg; #if defined(__STDC__) || defined(__cplusplus) extern int askTty(char *, char *, unsigned, int); #else extern int askTty(); #endif extern unsigned long defaultKey[64]; static char ident[] = " @(#) deslogind.c version 1.32 03-Mar-95 Copyright 1995 by Dave Barrett(barrett@asgard.cs.Colorado.EDU)\n"; static char RCSid[] = " @(#) deslogind.c $Revision: 1.13 $ $Date: 95/03/08 01:13:14 $\n"; char mainProgName[PROGNAME_SIZE]; char *progName, *argcName; int debug = 0; int verbose = 0; unsigned long inBytes = 0; /* for txfr */ unsigned long outBytes = 0; struct termios oldmodes; char *defaultShell = "/bin/ksh"; char *defaultArgv[] = { (char *) 0, /* substituted with arg0 variable later */ (char *) 0, /* if -w, then substitudet with loginArg1 */ (char *) 0, /* if -w, then remote host name */ (char *) 0 }; /* * Static data for -w option */ char loginArg1[] = "-h"; char loginProg[] = LOGIN_PROG; char loginCwd[] = "/"; void setProgName() { pid_t pid = getpid(); /* can't fail */ sprintf(mainProgName, "%s[%lu]", argcName, (unsigned long) pid); progName = mainProgName; } void sigHandler(sig) int sig; { switch (sig) { case SIGHUP: case SIGTERM: case SIGINT: log("%s: Terminated by signal %d\n", progName, sig); exit(1); /* make sure cleanup occurs on interrupt */ break; case SIGCHLD: /* child died */ if (debug) { log("%s: (main) SIGCHLD\n", progName); } break; default: break; } } char sname[PTY_NAMESIZE]; /* slave pty opened for shell control terminal */ char userName[USERNAME_SIZE]; /* login name of user */ char rhostName[MAX_HOSTNAME]; /* remote login host */ int chldStat = 0; /* * Registered with atexit */ void eraselogin() { int res; res = setlogin(sname, userName, rhostName, &chldStat); if (res < 0) { log("%s: WARNING--eraselogin \"%s\" failed--%s\n", progName, sname, ERRMSG); } res = chmod(sname, TTY_RWANY); if (res < 0) { log("%s: WARNING--chmod \"%s\" to %o failed--%s\n", progName, sname, TTY_RWANY, ERRMSG); } } /* * Duplicate the given file descriptor to the given mode with error check. */ int dupFd(fd, name, mode) int fd; char *name; mode_t mode; { int newfd, res; newfd = dup(fd); if (newfd < 0) { log("%s: dup of fd %d (\"%s\") failed--%s\n", progName, fd, name, ERRMSG); exit(1); } res = fcntl(newfd, F_SETFL, mode); if (res < 0) { log("%s: fcntl of fd %d (\"%s\") failed--%s\n", progName, newfd, name, ERRMSG); exit(1); } return newfd; } /* * Memory allocation with error check and abort */ void *allocate(size) register unsigned size; { register void *res = (void *) malloc(size); if (res == (void *) 0) { log("%s: allocate of %u bytes failed\n", progName, size); exit(1); } return res; } /* * Create a copy of the input string. (0 if out of memory) */ char *newString(chp) register char *chp; { register unsigned len = 0; register char *res; if (chp != (char *) 0) { len = strlen(chp); } res = (char *) allocate(len+1); if (res != (char *) 0) { memcpy(res, chp, len); res[len] = '\0'; } return res; } void showEnv(prefix, envp) char *prefix; register char **envp; { while (*envp != (char *) 0) { log("%s%s\n", prefix, *envp++); } log("\n"); } /* * Add a new entry to the given environment. Return the new environment. * Set input ep to NULL to create initial invironment * Frees the old environment. * * If out of memory occurs, 0 is returned */ char **updateEnv(ep, key, value) char **ep; char *key; char *value; { register char **chpp = ep, **dstp = (char **) 0, **res; char *newEntry = (char *) 0; unsigned int envsize = 0, keylen = 0, vallen = 0; if (key != (char *) 0) { keylen = strlen(key); } if (ep != (char **) 0) { while (*chpp != (char *) 0) { if (keylen != 0 && strncmp(key, *chpp, keylen) == 0) { dstp = chpp; } chpp++; } envsize = chpp - ep; } if (keylen != 0 && value != (char *) 0) { vallen = strlen(value); newEntry = (char *) allocate(keylen+vallen+2); if (newEntry == (char *) 0) { return (char **) 0; } memcpy(newEntry, key, keylen); memcpy(newEntry + keylen, "=", 1); memcpy(newEntry + keylen + 1, value, vallen); newEntry[keylen + vallen + 1] = '\0'; } if (dstp != (char **) 0) { if (newEntry != (char *) 0) { /* replace the entry */ free(dstp); *dstp = newEntry; return ep; } else { /* delete the entry */ *dstp = ep[envsize-1]; free(ep[envsize-1]); /* could cause problems */ ep[envsize-1] = (char *) 0; return ep; } } if (newEntry != (char *) 0) { envsize++; } res = (char **) allocate((envsize + 1) * sizeof (char *)); if (res == (char **) 0) { if (newEntry != (char *) 0) { free(newEntry); } return (char **) 0; } dstp = res; if (ep != (char **) 0) { chpp = ep; while (*chpp != (char *) 0) { *dstp++ = *chpp++; } } *dstp = (char *) 0; if (newEntry != (char *) 0) { *dstp++ = newEntry; } *dstp++ = (char *) 0; if (ep != (char **) 0) { free(ep); } return res; } char **setupEnv(userName, shell, cwd, path, tz, rhostName) char *userName, *cwd, *shell, *path, *tz, *rhostName; { register char **envp = updateEnv((char **) 0, (char *) 0, (char *) 0); #if defined(DEFAULT_MAIL) char envLine[1024]; #endif envp = updateEnv(envp, "HOME", cwd); /* sun POSIX xdm */ envp = updateEnv(envp, "PATH", path); /* sun POSIX xdm */ envp = updateEnv(envp, "LOGNAME", userName); /* sun POSIX */ #if defined(USER_ENV) /* BSD xdm */ envp = updateEnv(envp, USER_ENV, userName); #endif envp = updateEnv(envp, "SHELL", shell); /* sun xdm */ if (tz != (char *) 0) { envp = updateEnv(envp, "TZ", tz); /* POSIX */ } envp = updateEnv(envp, "TERM", DEFAULT_TERM); /* sun POSIX */ #if defined(DEFAULT_MAIL) /* hpux */ strcpy(envLine, DEFAULT_MAIL); strcat(envLine, userName); envp = updateEnv(envp, "MAIL", envLine); #endif /* * Add this environment variable to help users adjust their own login * scripts to a given remote enviroment and to detect remote logins * via this program. */ envp = updateEnv(envp, "RHOSTNAME", rhostName); /* deslogin feature */ /* * rlogin propigates TERM, baud rate, changes to window sizes */ return envp; } /* * Get information about the named user. Returns -1 for failure, 0 for success */ int getUserInfo(userName, shell, cwd, uid, gid) char *userName; char **shell; char **cwd; uid_t *gid; uid_t *uid; { register struct passwd *pwentp; register int res = -1; pwentp = getpwnam(userName); if (pwentp != (struct passwd *) 0) { *uid = pwentp->pw_uid; *gid = pwentp->pw_gid; *cwd = newString(pwentp->pw_dir); *shell = newString(pwentp->pw_shell); res = 0; } return res; } /* * Return CPU time consumed by this process and it's children in 1/10 seconds. * * Processes run by the shell "time" command will not be accumulted. */ long cpuTime() { struct tms pt; clock_t curTime; long res; curTime = times(&pt); res = pt.tms_utime + pt.tms_cutime + pt.tms_stime + pt.tms_cstime; res = (res * 10) / sysconf(_SC_CLK_TCK); return res; } /* * Get and validate the userfile cipher key. Returns the binary key or -1. * * If noUserKey is 1, then userKey is 0, and the userFile is not encrypted. * Otherwise, it's expected to have been encrypted with the cipher program. */ keyType getUserFileKey(userFile, userPhrase, noUserKey) char *userFile; char *userPhrase; int noUserKey; { int res; char passPhrase[PHRASE_SIZE]; keyType userKey = 0; if (noUserKey && userPhrase) { log("%s: can't use -n option if UserFile cipher key given\n", progName); return (keyType) -1; } if (!noUserKey) { if (userPhrase == (char *) 0) { /* user for passphrase if none given */ res = askTty("UserFile cipher key: ", passPhrase, PHRASE_SIZE-1, 0); if (res < 0) { log("%s: couldn't get key\n", progName); return (keyType) -1; } userPhrase = passPhrase; } if (userPhrase == (char *) -1) { userKey = (keyType) &defaultKey[0]; /* use compile-time key */ } else { userKey = mkKey(userPhrase); memset(userPhrase, '\0', strlen(userPhrase)); /* possibly optarg */ if (userKey == (keyType) 0) { log("%s: couldn't make key\n", progName); return (keyType) -1; } } } /* * Make userfile exists and the correct key was specified */ res = getUserPhrase(userFile, passPhrase, PHRASE_SIZE, "#", userKey); if (res == -1) { log("%s: cannot open \"%s\" for user database\n", progName, userFile); return (keyType) -1; } if (res == -2) { log("%s: incorrect decryption key for user database \"%s\"\n", progName, userFile); return (keyType) -1; } return userKey; } int handleSignals() { register char *chp; /* * To make sure we cleanup utmp with atexit if we're aborted */ chp = (char *) posignal(SIGINT, sigHandler); if (chp == (char *) SIG_ERR) { log("%s: sigaction SIGINT failed--%s\n", progName, ERRMSG); return -1; } /* * Sent by kill command with no arguments */ chp = (char *) posignal(SIGTERM, sigHandler); if (chp == (char *) SIG_ERR) { log("%s: sigaction SIGTERM failed--%s\n", progName, ERRMSG); return -1; } /* * Controlling terminal hangup, or death of controlling process */ chp = (char *) posignal(SIGHUP, sigHandler); if (chp == (char *) SIG_ERR) { log("%s: sigaction SIGHUP failed--%s\n", progName, ERRMSG); return -1; } return 0; } /* * Became a deamon */ pid_t becomeDaemon() { pid_t pid = getpid(); if (debug < 2) { /* deamon: disassociate from controlling terminal */ pid = fork(); /* make pgid != pid for setsid() */ if (pid < 0) { log("%s: unable to fork as daemon--%s\n", progName, ERRMSG); return -1; } if (pid > 0) { /* the parent is finished */ exit(1); } /* child */ setProgName(); pid = setsid(); /* break control terminal affiliation */ if (pid == -1) { log("%s: setsid failed--%s\n", progName, ERRMSG); return -1; } /* * We may still have a problem here. When the child dies, we will * create a zombie which will have to be waited for by the parent! * Since we're a session leader, presumably that parent is now init. */ } return pid; } /* * Negotiate protocol with remote site. * Return the selected protocol or 0 for failure. */ char *serverHandshake(nfd, rhostName, rport, timeout) int nfd; char *rhostName; int rport; unsigned timeout; { int len, res, count; static char protover[VERS_SIZE]; len = strlen(PROTOCOL_VERS); res = write(nfd, PROTOCOL_VERS, len+1); if (debug) { log("%s: server protocol \"%-.*s\"\n", progName, len, PROTOCOL_VERS); } if (res < 0) { log("%s: write (%d, \"%-.*s\", %d) failed--%s\n", progName, nfd, len, PROTOCOL_VERS, len+1, ERRMSG); return 0; } count = getString(nfd, protover, VERS_SIZE-1, timeout); if (count == 0) { log("%s: NOPROTO %s:%d\n", progName, rhostName, rport); return 0; } if (debug) { log("%s: client protocol \"%-.*s\"\n", progName, VERS_SIZE-1, protover); } if (protover[0] != PROTOCOL_VERS[0]) { log("%s: BADPROTO(%-.*s) %s:%d\n", progName, count, protover, rhostName, rport); return 0; } return &protover[0]; } /* * Set the supplementary group id's for the specified user with error checking * * Returns: 0 success, -1 if failure (warning issued) */ int setupGroups(userName) char *userName; { int res = -1, ngroups, groups; /* number of supplementary group ids */ gid_t *gidset; /* * Supplementary group ids are inherited from the parent. They * should be changed if they exist. Supplementary group id's are * checked against the target gid of chmod(), chown(). */ ngroups = (int) sysconf(_SC_NGROUPS_MAX); if (ngroups >= 0) { gidset = (gid_t *) malloc((ngroups+1) * sizeof (gid_t)); if (gidset == (gid_t *) 0) { log( "%s: WARNING--couldn't allocate %d entry supplementary group list\n", progName, ngroups); } else { groups = getLoginGroups(ngroups, gidset, userName); if (groups < 0) { log("%s: WARNING--getLoginGroups(%d, %s) failed--%s\n", progName, ngroups, userName, ERRMSG); } else { if (groups > ngroups) { log( "%s: WARNING--only first %d of %d supplementary groups set\n", progName, ngroups, res, userName); groups = ngroups; } res = setGroups(groups, gidset); if (res < 0) { log("%s: WARNING--setgroups(%d) failed--%s\n", progName, groups, ERRMSG); } } free(gidset); } } return res; } /* * Set the user's uid, gid, and supplementary gid's which determine * the capabilities for this process. */ void setupUser(uid, gid, userName) uid_t uid; gid_t gid; char *userName; { int res; res = setgid(gid); /* must setgid before setuid */ if (res != 0) { log("%s: setgid to %d failed--%s\n", progName, gid, ERRMSG); exit(1); } /* * Supplementary group ids are inherited from the parent. They * should be changed if they exist. Supplementary group id's are * checked against the target gid of chmod(), chown(). */ res = setupGroups(userName); /* * If res < 0, setupgroups failed, but that's OK, warning issued. */ /* * We may lose the ability to update the log file with log() after this */ res = setuid(uid); if (debug > 1) { log("%s: setuid: returned %ld\n", progName, (long) res); } if (res != 0) { log("%s: setuid to %d failed--%s\n", progName, uid, ERRMSG); exit(1); } } int main(argc, argv) int argc; char *argv[]; { int ch, count, sin, sout, serr, res, ttyfd, noUserKey = 0; long cpuUsed; char *chp, *shell, *cwd, *arg0, *tz, *protocol; char *path = USERPATH, *userFile = USER_FILE, *logName = LOG_FILE, buf[2]; char **cargv = defaultArgv, **cenv = (char **) 0; char ruser[USERNAME_SIZE], passPhrase[PHRASE_SIZE]; char *userPhrase = (char *) 0, *generic = (char *) 0; char mname[PTY_NAMESIZE]; unsigned port = 0, rport = 0; unsigned connTimeout = 1000 * INACTIVITY_TIMEOUT; unsigned loginTimeout = 1000 * LOGIN_TIMEOUT; /* login timer */ unsigned bufSize = 128; /* connection bufsize */ int masterpty = -1, slavepty = -1, nfd = -1, pty = 1, stype; int pipe0[2], pipe1[2], pipe2[2]; mode_t newmask = DEFAULT_UMASK, oldmask; pid_t pid, pid_res; uid_t uid; gid_t gid; time_t loginTime; keyType key = (keyType) 0, userKey; argcName = *argv; if ((chp = strrchr(argcName, '/')) != (char *) 0) argcName = chp + 1; progName = argcName; stype = issocket(0); if (stype > 0) { /* if we're invoked from inetd */ res = openLog(logName); if (res < 0) { _exit(1); } } while ((ch = getopt(argc, argv, "w:k:Pl:t:i:f:p:dvnc")) != EOF) switch (ch) { case 'c': /* user compile'd userFile key */ userPhrase = (char *) -1; break; case 'k': /* user file cipher key */ userPhrase = optarg; break; case 'n': /* no user file cipher key */ noUserKey++; break; case 'P': pty = 0; /* pipeline instead of pty */ break; case 'l': logName = optarg; break; case 'i': /* idle timeout */ count = sscanf(optarg, "%u", &connTimeout); /* in seconds */ if (count != 1) goto usage; connTimeout *= 1000; break; case 't': /* passphrase timeout */ count = sscanf(optarg, "%u", &loginTimeout); /* in seconds */ if (count != 1) goto usage; loginTimeout *= 1000; break; case 'f': /* set userfile */ userFile = optarg; break; case 'p': /* bind to port # */ count = sscanf(optarg, "%u", &port); if (count != 1) goto usage; break; case 'w': /* function as wrapper for login */ generic = optarg; /* name in userfile with system-wide passphrase */ break; case 'v': verbose++; break; case 'd': debug++; break; default: usage: log( "usage: %s [-dn] [-w name ] [-i inactiveSecs ] [-t loginSecs ] [-l logfile ] [-f userfile ] [-k userfileCipherKey ] [-p port ]\n", progName); return 1; } argc -= optind; argv += optind; if (debug > 1) { log("%s: issocket(0) returned %d\n", progName, stype); } userKey = getUserFileKey(userFile, userPhrase, noUserKey); if (userKey == (keyType) -1) { return 1; } /* * Open log *after* options parsed and some simple error checking, * and *before* closing fd's 0,1, and 2. */ res = openLog(logName); /* leaves existing log if failed */ if (res < 0) { log("%s: couldn't open logfile \"%s\"--%s\n", progName, logName, ERRMSG); return 1; } setProgName(); res = handleSignals(); /* handle quit attempts */ if (res < 0) { return 1; } /* * The remote host name is not trustworthy for several reasons. * We don't use it (or the remote IP address) for authentication. * Relying on the Domain Name System, or the remote IP address * is not something I'm willing to trust. Here, we use it strictly * for logging, and informational purposes (who, RHOSTNAME, etc). */ if (getRemoteAddr(0, rhostName, sizeof rhostName, &rport) == 0) { nfd = 0; /* From inetd. 0 and 1 is our socket. */ close(2); /* inetd leaves it open */ } else { /* Interactive invocation */ if (port == 0) { port = getServicePort(SERVICE_NAME); if ((int) port < 0) { port = DESLOGIN_PORT; log( "%s: WARNING--no \"%s\" service; using port %u\n", progName, SERVICE_NAME, port); } } log("%s: Starting daemon pid %ld port %d\n", progName, (unsigned long) getpid(), port); /* * Must close fds 0,1, and 2 *before* openServer and becomeDaemon */ close(0); close(1); close(2); pid = becomeDaemon(); if (pid < 0) { return 1; /* messages already logged */ } nfd = openServer(port, rhostName, sizeof rhostName, &rport, (debug < 2)); if (nfd < 0) { log("%s: open network port %d failed--%s\n", progName, port, ERRMSG); return 1; } setProgName(); /* Openserver did a fork when it returned successfully */ /* * Openserver handed us nfd as fd 1, 0 is now available */ } log("%s: connect %s:%d\n", progName, rhostName, rport); protocol = serverHandshake(nfd, rhostName, rport, SETUP_TIMEOUT); if (!protocol) { return 1; /* log already done */ } count = getString(nfd, ruser, USERNAME_SIZE-1, SETUP_TIMEOUT); if (count == 0) { log("%s: NORUSER %s:%d\n", progName, rhostName, rport); return 1; } count = getString(nfd, userName, USERNAME_SIZE-1, SETUP_TIMEOUT); if (count == 0) { log("%s: NOLUSER %s@%s:%d\n", progName, ruser, rhostName, rport); return 1; } /* * Minimize the the time the phrase must me visible in memory. */ if (generic) { chp = generic; } else { chp = userName; } res = getUserPhrase(userFile, passPhrase, PHRASE_SIZE, chp, userKey); if (res == 0) { log("%s: NOPHRASE %s@%s:%d->\"%s\"\n", progName, ruser, rhostName, rport, chp); return 1; } if (res == -1) { log("%s: cannot open \"%s\" for user database\n", progName, userFile); return 1; } if (res == -2) { log("%s: incorrect decryption key for user database \"%s\"\n", progName, userFile); return 1; } key = challenge(nfd, passPhrase, loginTimeout); if (key == (keyType) 0) { log("%s: BADLOGIN %s@%s:%d->\"%s\"\n", progName, ruser, rhostName, rport, userName); return 1; } memset(passPhrase, '\0', PHRASE_SIZE); if (!generic) { res = getUserInfo(userName, &shell, &cwd, &uid, &gid); if (res < 0) { log("%s: NOUSER %s@%s:%d->\"%s\"\n", progName, ruser, rhostName, rport, userName); return 1; } } else { shell = loginProg; cwd = loginCwd; /* not used except for log message */ uid = getuid(); /* cannot fail */ gid = getgid(); /* cannot fail */ } /* * If /etc/nologin exists, just copy it to the port and terminate. */ #if defined(NOLOGIN_FILE) res = open(NOLOGIN_FILE, O_RDONLY, 0); if (res >= 0) { log("%s: NOLOGIN %s@%s:%d->%s\n", progName, ruser, rhostName, rport, userName); cipherCopy(nfd, res, 2, key); /* two seconds max to blast it out */ close(res); exit(1); } #endif /* * We really should log the tty assigned, and pid of the shell as well */ log("%s: Login %s@%s:%d as %s(%u:%u) %s %s\n", progName, ruser, rhostName, rport, userName, uid, gid, cwd, shell); time(&loginTime); if (pty) { /* * We only need to do all this pty stuff and forking, if we want * the local process to use a the slave tty interface. This will * not always be the case. We should add a feature to eliminate it * for remote commands that do not need a tty as stdin, stdout & stderr. * * The openPty below make the slave the controlling terminal for * this process, unless we use O_NOCTTY. */ masterpty = openPty(O_RDWR | O_NOCTTY, sname, mname, PTY_NAMESIZE, &slavepty); if (masterpty < 0) { log("%s: no pty's available\n", progName); exit(1); } /* * Better make sure this close relinquishes the slavepty as the * controlling terminal if it was. Otherwise, the child will be unable * to reacquire it as the controlling terminal and exit. * * DEC Ultrix 4.3 definitely ignores O_NOCTTY, but this code makes * sure that is harmless by closing the slave before the fork below. * * In fact, I can't figure out a way to force Ultrix to give me * a controlling terminal. It claims I got one, but then when I * try to relinquish it, it fails ENOTTY. tcgetpgrp is really busted * on this machine. */ pid_res = tcgetpgrp(slavepty); if (debug > 1) { log("%s: tcgetpgrp(%d) returned pid %d\n", progName, slavepty, pid_res); } if (debug && (pid_res >= (pid_t) 0)) { log("%s: WARNING--%s fd %d is controlling terminal of daemon!\n", progName, sname, slavepty); res = mkCtrlTty(slavepty, 0); if (debug > 1) { log("%s: mkCtrlTty(%d) returned %d\n", progName, slavepty, res); } if (res < 0) { log("%s: WARNING--couldn't relinquish control terminal--%s\n", progName, ERRMSG); } } close(slavepty); /* * The next three calls can fail when running as a normal user */ res = chmod(sname, TTY_MODE); if (res < 0) { log("%s: WARNING--chmod(\"%s\",0%o) failed--%s\n", progName, sname, TTY_MODE, ERRMSG); } res = chown(sname, uid, gid); if (res < 0) { log("%s: WARNING--chown(\"%s\",%d,%d) failed--%s\n", progName, sname, uid, gid, ERRMSG); } if (debug) { log("%s: \"%s\" %d->%d \"%s\"\n", progName, mname, masterpty, slavepty, sname); } } else { /* pipe */ /* * We must make sure these are not fd's 0, 1, or 2, so this first * call is just to use them up if necessary. */ res = pipe(pipe2); if (res < 0) { log("%s: pipe failed--%s\n", progName, ERRMSG); exit(1); } res = pipe(pipe1); if (res < 0) { log("%s: pipe failed--%s\n", progName, ERRMSG); exit(1); } res = pipe(pipe0); if (res < 0) { log("%s: pipe failed--%s\n", progName, ERRMSG); exit(1); } close(pipe2[0]); close(pipe2[1]); if (debug) { log("%s: pipe (%d>%d) (%d<%d)\n", progName, pipe0[1], pipe0[1], pipe1[0], pipe1[1]); } } /* * POSIX states default is not to receive signal when child dies (or stops) * We want to know when it happens. We must do this before the fork * to prevent a race condition. We must catch this signal to force * the select call in txfr to interrupt when the child dies. Note thhat * this may do nothing if on systems where sysconf(_SC_JOB_CONTROL) * returns 0 (although System V may implement SIGCHLD as SIGCLD.). We'll * just have to assume that this will allow us to detect when the child * dies. If not, the symptom is that exiting the remote shell will just * hang until the INACTIVITY_TIMEOUT (connTimeout) expires. */ chp = (char *) posignal(SIGCHLD, sigHandler); if (chp == (char *) SIG_ERR) { log("%s: sigaction SIGCHLD failed--%s\n", progName, ERRMSG); return 1; } /* * This fork is necessary to reset much of the process state and * to ensure that setsid won't fail because we're a process group leader * It is also needed to transport data from the pty to the socket * (or control terminal) from the remote shell. * * Sect3:15: fork() ensures that child pid != any active pgid */ pid = fork(); if (pid != 0) { /* parent */ if (pid < 0) { /* fork failure */ log("%s: fork failed--%s\n", progName, ERRMSG); exit(1); } setProgName(); if (debug) { log("%s: parent pid %d; child pid %ld\n", progName, getpid(), (long) pid); } if (pty) { /* * This must be done after we have a pty, and before we do a setuid. * It updates the utmp file so getlogin and who will work corretly. * It should be done only by the parent. * It's required on hp-ux even for -w (wrapper) option. */ res = setlogin(sname, userName, rhostName, 0); if (res < 0) { log("%s: WARNING--setlogin %s to %s@%s failed--%s\n", progName, sname, userName, rhostName, ERRMSG); } res = atexit(eraselogin); if (res < 0) { log("%s: WARNING--atexit of eraselogin failed--%s\n", progName, ERRMSG); } /* * There is a race condition between the parent and the child. * On DEC, if the parent executes txfr before the child opens the * slave, we'll abort with an I/O error. Wait until pty is ready. */ res = waitReady(masterpty, buf, 1, SETUP_TIMEOUT); if (debug > 1) { log("%s: waitReady(%d,%u)=%d\n", progName, masterpty, SETUP_TIMEOUT, res); } if (res <= 0) { if (res < 0 && errno != EINTR) { /* fail, and not SIGCHLD */ log("%s: master pty handshake failed--%s\n", progName, res, ERRMSG); } else if (res == 0) { log("%s: master pty handshake failed\n", progName, res); } } else { if (debug) { log("%s: txfr %d-decrypt->%d\n", progName, nfd, masterpty); } res = txfr(nfd, masterpty, masterpty, bufSize, connTimeout, key); } } else { /* pipe */ close(pipe0[1]); close(pipe1[0]); if (debug) { log("%s: txfr pipe %d->%d<-%d\n", progName, pipe0[0], nfd, pipe1[1]); } res = txfr(nfd, pipe0[0], pipe1[1], bufSize, connTimeout, key); } /* * Really should be registered with atexit, but since it's just * a session key anyway, it's not insecure to let's its carcass * rot in inaccessible bits of free space. */ destroyKey(&key); /* * Reap all terminated children so we don't leave zombie processes * and make sure our child CPU times are updated. Waitpid returns * -1 when all children have been reaped, and 0 if still have * unterminated children. */ do { pid = waitpid(-1, &chldStat, WNOHANG); if (debug) { log("%s: waitpid returned %ld\n", progName, (long) pid); } } while (pid > 0); cpuUsed = cpuTime(); loginTime = time((time_t *) 0) - loginTime; if (res != 0) { log( "%s: Logout %s on %u(%ld%c%ld) sec(CPU), %lu/%lu bytes in/out\n", progName, userName, loginTime, cpuUsed / 10, '.', cpuUsed % 10, inBytes, outBytes); } else { log( "%s: Logout %s on %u(%ld%c%ld) sec(CPU), %lu/%lu bytes in/out (idle %u sec)\n", progName, userName, loginTime, cpuUsed / 10, '.', cpuUsed % 10, inBytes, outBytes, connTimeout / 1000); } exit(0); } /* child */ setProgName(); if (generic) { cargv[1] = loginArg1; cargv[2] = rhostName; } else { tz = getenv("TZ"); /* may fail by returning NULL; OK though */ if (uid == 0) { /* root user gets special path */ path = SYSTEMPATH; } cenv = setupEnv(userName, shell, cwd, path, tz, rhostName); res = chdir(cwd); if (res != 0) { log("%s: chdir to %s failed \"%s\"--%s\n", progName, cwd, ERRMSG); return 1; } oldmask = umask(newmask); /* documentation says umask cannot fail! */ /* * This code must be placed only in the child because of the atexit call * in the parent for updating utmp. This changes the uid, and gid now. */ setupUser(uid, gid, userName); /* exits if failure */ } if ((chp = strrchr(shell, '/')) == (char *) 0) chp = shell-1; chp++; arg0 = (char *) malloc(strlen(chp)+2); if (arg0 == (char *) 0) { log("%s: couldn't allocate %d bytes for arg0\n", progName, strlen(chp)+2); exit(1); } arg0[0] = '-'; /* make this a login shell */ memcpy(&arg0[1], chp, strlen(chp)+1); cargv[0] = arg0; /* * Sect4.3.2:157-177: * If the calling process is not a process group leader, the setsid() * function shall create a new session. The calling process shall be * the session leader of this new session, shall be be the process * group leader of a new process group, and shall have no controlling * terminal. The process group ID of the calling process shall be * set equal to the process ID of the calling process. The calling * process shall be the only process in the new proccess group and the * only process in the new session. * Upon successful completion, the setsid() function returns the value * of the process group ID of the calling process. Otherwise, a value of * -1 is returned and errno is set to indicate the error. * * EPERM - The calling process is already a process group leader, or * the process group ID of a process other than the calling process * matches the process id of the calling process * * D.A.B.: the fork() made sure that pgid != pid, and * we're not a pg leader because we didn't call setpgid. * * NOTE: getpgrp() expects an argument on BSD, but not POSIX. If * if you have BSD, (DEC MIPS, SunOS4.1), you should pass it 0. */ if (debug > 1) { log("%s: getpid: %ld\n", progName, (long) getpid()); log("%s: getpgrp: %ld\n", progName, (long) getpgrp()); } pid = setsid(); /* break control terminal affiliation; get sid */ /* * Any open of a terminal device after setsid without O_NOCCTY will likely * become the controlling terminal. */ if (pid == -1) { log("%s: setsid failed--%s\n", progName, ERRMSG); return 1; } if (debug > 1) { log("%s: setsid: %ld\n", progName, (long) pid); log("%s: getpid: %ld\n", progName, (long) getpid()); log("%s: getpgrp: %ld\n", progName, (long) getpgrp()); } close(0); /* actually, we should close ALL fd's here */ close(1); /* this should be all of them */ close(2); /* we made sure none of these are needed below */ close(nfd); /* they must be free for dup's to work */ if (pty) { close(masterpty); /* * This was designed to prevent someone from hooking upto the slave before * the child could. It doesn't. I've moved the close before the fork. */ #if 0 /* must be as close as possible to the open * to reduce the race condition for someone hijacking the slave pty * before this process can get it. There needs to be a better way. * * There was a bug here if the parent still opened the slave as * a controlling terminal, and it hasn't closed slavepty before we do * here. That's why O_NOCTTY is specified to openPty above. */ close(slavepty); #endif /* * Sect7.2.3:753-765: * Upon successful completion, tcgetpgrp() returns the process group ID * of the foreground process group associated with the terminal. If * there is no foreground process group, tcgetpgrp() shall return a value * greater than 1 that does not match the process group ID of any * existing process group. Otherwise, a value of -1 is returned and * errno is set to indicate the error. * * EBADF - The filedes argument is not a valid file descriptor * ENOSYS - The tcgetprgp() function is not supported in this * implementation * ENOTTY - The calling process does not have a controlling terminal, * or the file is not the controlling terminal. */ /* * Establish a new control terminal by being the first process without * a controlling terminal to open a tty device. Non-POSIX, but * very common. * * The close must happen as close as possible with the open to prevent * hijacking of the slave side of the pty. Note that on some systems * this may cause the master to get notified and abort prematurely. I * don't think this exists now because of SIGCHLD being used instead. * * AnnexB:3884-3887: * POSIX.1 does not specify a mechanism by which to allocate a * controlling terminal...Historical implementations allocate controlling * terminals on certain open() calls...Some historical implementations * deallocate a controlling terminal on its last systemwide close. * This behavior is neither required nor prohibited. Even on * implementations that do provide this behavior, applications cannot * depend on it due to its systemwide nature. * * Sect5:204-206: O_NOCTTY if set, and path identifies a terminal device, * the open() function shall not cause the terminal device to become the * controlling terminal for the process (see 7.1.1.3) * * Sect7.1.1.3:42-68: * ...The controlling terminal for a session is allocated by the session * leader in an implementation-defined manner. If a session leader has * no controlling terminal and opens a terminal device file that is not * already associated with a session without using the O_NOCTTY option * (see 5.3.1), it is implementation defined whethere the terminal * becomes the controlling terminal of the session leader. If a process * that is not a session leader opens a terminal file, or the O_NOCTTY * option is used on open(), that terminal shall not become the the * controlling terminal of the calling process. When a controlling * terminal becomes associated with a session, its foreground process * group shall be set to the process group of the session leader. * The controlling terminal is inherited by the child process during a * fork() function call. A process relinquishes its controlling terminal * when it creates a new session with the setsid() function; other * processes remaining in the old session that had this terminal as * their controlling terminal continue to have it. Upon the close of * the last file descriptor in the system (whether or not it is in the * current session) associated with the cntrolling terminal, it is * unspecified whether all process that had the terminal cease to have * any controlling terminal. Whether and how a session leader can * reacquire a controlling terminal after the controlling terminal has * been relinquished in this fashion is unspecified. A process does not * relinquish its controlling terminal simply by closing all of its * file descriptiors associated with the controlling terminal if other * processes continue to have it open. * When a controlling process terminates, the controlling terminal * is disassociated from the current session, allowing it to be acquired * by a new session leader. Subsequent access to the terminal by other * processes in the earlier session may be denied, with attempts to * access the terminal treated as if a modem disconnect had been sensed. * * Sect7.2.4:775-800 * If the process has a controlling terminal, the tcsetpgrp() function * shall set the foreground process group ID associated with the * terminal to pgrp_id. The file associated with filedes must be the * controlling terminal of the calling process, and the controlling * terminal must be currently associated with the session of the * calling process. The value of pgrp_id must match a process * group ID of a process in the same session as the calling process. * Upon successful completion, tcsetpgrp() returns a value of zero. * Othewise, a value of -1 is returned, and errno is set to indicate the * error. * EBADF - The filedes argument is not a valid file descriptor. * EINVAL - The value of pgrp_id argument is not supported by the * implementation. * ENOSYS - The tcsetpgrp() function is not supported in this * implementation. * ENOTTY - The calling process does not have a controlling terminal, or * the file is not the controlling terminal, or the controlling * terminal is no longer associated with the session of the * calling process. * EPERM - The value of pgrp_id is a value supported by the * implementation, but does not mmatch the process group ID of a * process in the same session as the calling process. * * HP-UX_9.0:termio(7) man page states: * A terminal can belong to a process as its controlling terminal. Each * process of a session that has a controlling terminal has the same * controlling terminal. A terminal can be the controlling terminal for * at most one session. The controlling terminal for a session is * allocated by the session leader. If a session leader has no * controlling terminal and opens a terminal device file that is not * already associated with a session without using the O_NOCTTY option * (see open(2), the terminal becomes the controlling terminal of the * session and the controlling terminal's foreground process group is set * to the process group of the session leader. While a controlling * terminal is associated with a session, the session leader is said to * be the controlling process of the controlling terminal. * The controlling terminal is inherited by a child process during a * fork() (see fork(2)). A process relinquishes its controlling terminal * if it creates a new session with setsid() or setpgrp() (see setsid(2) * and setpgrp(2)), or when all file descriptors associated with the * controlling terminal have been closed. * When the controlling process terminates, the controlling terminal is * disassociated from the current session, allowing it to be acquired by * a new session leader. A SIGHUP signal is sent to all processes in the * foreground process group of the controlling terminal. Subsequent * access to the terminal by other processes in the earlier session can * be denied (see Terminal Access Control) with attempts to access the * terminal treated as if a modem disconnect had been sensed. * * Ultrix4.3pty(4): The slave device can be opened multiple times, while * the master half can be opened only once. [EIO] An attempt to open * the slave side of the pty was made before opening the master side of * the pty. */ sin = openSlavePty(sname, O_RDWR); if (sin < 0) { log("%s: open slave pty \"%s\" for read-write failed--%s\n", progName, sname, ERRMSG); exit(1); /* sends SIGCHLD to parent */ } res = mkCtrlTty(sin, 1); if (debug > 1) { log("%s: mkCtrlTty(%d, %d) returned %d\n", progName, sin, 1, res); } if (res < 0) { log( "%s: mkCtrlTty(%d) didn't acquire %s as contrlling terminal--%s\n", progName, sin, sname, ERRMSG); exit(1); } res = tcsetpgrp(sin, pid); if (debug > 1) { log("%s: tcsetpgrp(%d, %d) returned %d\n", progName, sin, pid, res); } if (res < 0) { log("%s: could not acquire fd %d (%s) as controlling terminal--%s\n", progName, sin, sname, ERRMSG); exit(1); } res = setTtyAscii(sin); /* initialize modes for ASCII I/O */ res = mkReady(sin, buf, 1, SETUP_TIMEOUT); if (debug > 1) { log("%s: mkReady(%d,%d)=%d\n", progName, sin, SETUP_TIMEOUT, res); } if (res < 0) { log("%s: slave pty handshake failed--%s\n", progName, ERRMSG); exit(1); } if (res == 0) { log("%s: slave pty handshake failed.\n", progName); exit(1); } sout = dupFd(sin, sname, O_WRONLY); serr = dupFd(sin, sname, O_RDWR); res = fcntl(sin, F_SETFL, O_RDONLY); if (res < 0) { log("%s: fcntl of \"%s\" for read-only failed--%s\n", progName, sname, ERRMSG); exit(1); } if (debug > 1) { log("%s: STDIN = %d, STDOUT = %d, STDERR = %d\n", progName, sin, sout, serr); } /* * Make sure open(ctermid(NULL)) works. * * If you get a compile time error here on linux, it's because linux * forgot to add an extern for ctermid in unistd.h. Fix your include * file or add "extern char *ctermid();" above. Hopefully, linux will * fix this error in the next release. */ chp = ctermid((char *) 0); /* In POSIX */ if (chp == (char *) 0 || *chp == (char) 0) { log("%s: WARNING--ctermid(0) failed --%s\n", progName, ERRMSG); } else { ttyfd = open(chp, O_RDWR); if (ttyfd == -1) { log("%s: WARNING--open(\"%s\", O_RDWR) failed --%s\n", progName, chp, ERRMSG); } close(ttyfd); } /* * Make sure getlogin works. If not, setlogin didn't work. You will * need to repair setlogin.c. This call can still fail if the parent * still hasn't called setlogin by now. */ chp = (char *) getlogin(); if (chp == (char *) 0) { log("%s: WARNING--getlogin returned NULL\n", progName); } else { if (debug > 1) { log("%s: getlogin returned \"%s\"\n", progName, chp); } } } else { /* pipe */ close(pipe0[0]); close(pipe1[1]); sin = dupFd(pipe1[0], "pipe1[0]", O_RDONLY); close(pipe1[0]); sout = dupFd(pipe0[1], "pipe0[1]", O_WRONLY); close(pipe0[1]); serr = dupFd(sin, "serr", O_RDWR); } /* * Effect of exec: * * Unchanged: * POSIX State: * open files and state (including locks) * pid, pgid, ppid, sid, ruid, rgid, * * chroot(), chdir(), umask(), getlogin(), ctermid() * getgroups() * times() * alarm(), sigpending(), sigprocmask(), * * Note that fork() updates: * pid, ppid, times(), alarm(), sigpending(), file locks, * own copy of fd's, directory streams; alarm cleared. * * Non-posix state: * ptrace(), semop(). * ulimit() nice() rtprio() * semop() * ptrace() * setitimer() * * Changed: * euid, egid, suid, sgid - changed if exec file has setuid/gid * caught signals are set to SIG_DFL * * shmop(2) - none attached * profil(2) - profiling disabled */ if (debug) { if (generic) { log("%s: exec \"%s\" as \"%s %s %s\"\n", progName, shell, cargv[0], cargv[1], cargv[2]); } else { log("%s: exec \"%s\" as \"%s\"\n", progName, shell, cargv[0]); } if (debug > 1) { log("%s: env:\n", progName); showEnv(" ", cenv); } } closeLog(); res = execve(shell, cargv, cenv); if (res < 0) { return 1; } return 0; } * * shmop(2) - none attached * profil(2) - profiling disabled */ if (debug) { if (generic) { log("%s: exec \"%s\" as \"deslogin-1.3/deslogingw.c000044400001450000013000000164220572542157600165440ustar00barrettsystem00000000000000/* * @(#) deslogingw.c RCS: $Revision: 1.5 $ $Date: 95/03/02 12:54:10 $ * * Gateway for deslogin to deslogind * * Actually, this program is much more general. Any remote user who knows * the correct gateway passphrase may use this gateway to connect to any * port number on any machine. The authentication is secure, but the * data flowing through the connection made by this program is not changed * in any way. It is up to the remote clients to perform any additional * authentication or channel encryption (as deslogin/deslogind do). * * Copyright 1994 David A Barrett. */ #define _POSIX_SOURCE #include /* close getlogin */ #include /* atexit exit */ #include #include #include #include #include /* for fcntl.h */ #include #include #include /* time asctime */ #include /* WNOHANG */ #include "posignal.h" #include "log.h" #include "tty.h" #include "auth.h" #include "txfr.h" #include "socket.h" #include "deslogin.h" #include "log.h" #define MAX_HOSTNAME 255 #if !defined(GW_LOG_FILE) #define GW_LOG_FILE "/usr/adm/deslogingw.log" #endif extern int optind; extern char *optarg; #if defined(__STDC__) || defined(__cplusplus) extern int askTty(char *, char *, unsigned, int); #else extern int askTty(); #endif static char ident[] = " @(#) deslogingw.c version 1.01 09-Apr-94 Copyright 1994 by Dave Barrett(barrett@asgard.cs.Colorado.EDU)\n"; char mainProgName[255]; char *progName, *argcName; int debug = 0; int verbose = 0; unsigned long inBytes = 0; /* for txfr */ unsigned long outBytes = 0; void setProgName() { pid_t pid = getpid(); /* can't fail */ sprintf(mainProgName, "%s[%lu]", argcName, (unsigned long) pid); progName = mainProgName; } void sigHandler(sig) int sig; { switch (sig) { case SIGHUP: case SIGTERM: case SIGINT: log("%s: Terminated by signal %d\n", progName, sig); exit(1); /* make sure cleanup occurs on interrupt */ break; case SIGCHLD: /* child died */ if (debug) { log("%s(main): SIGCHLD\n", progName); } break; default: break; } } int main(argc, argv) int argc; char *argv[]; { int ch, count, res, chldStat; unsigned bufSize = 127; char *chp, *logName = GW_LOG_FILE; int sfd, dfd; unsigned rport, dport = DESLOGIN_PORT, sport = DESLOGIN_GW_PORT; char passPhrase[PHRASE_SIZE], *tp = (char *) 0; char rhostName[MAX_HOSTNAME], hostName[MAX_HOSTNAME], aport[16]; char protover[VERS_SIZE]; unsigned loginTimeout = 1000 * (LOGIN_TIMEOUT + 1); /* login timer */ pid_t pid; keyType key; argcName = *argv; if ((chp = strrchr(argcName, '/')) != (char *) 0) argcName = chp + 1; progName = argcName; while ((ch = getopt(argc, argv, "dvp:h:l:")) != EOF) switch (ch) { case 'h': tp = optarg; break; case 'p': count = sscanf(optarg, "%d", &sport); if (count != 1) goto usage; break; case 'v': verbose++; break; case 'd': debug++; break; case 'l': logName = optarg; break; default: usage: fprintf(stderr, "usage: %s [-dv] [-p serverport ] [-l logFile ]\n", progName); exit(1); } argc -= optind; argv += optind; res = askTty("Gateway Pass phrase: ", passPhrase, PHRASE_SIZE-1, 0); if (res < 0) { fprintf(stderr, "%s: couldn't get pass phrase\n", progName); exit(1); } res = openLog(logName); if (res < 0) { fprintf(stderr, "%s: couldn't open logfile \"%s\"\n", progName, logName); exit(1); } if (!debug) { /* Disassociate ourselves with any controlling terminal or session */ close(0); close(1); close(2); pid = fork(); if (pid < 0) { log("%s: unable to fork as daemon--%s\n", progName, ERRMSG); exit(1); } if (pid > 0) { /* the parent is finished */ exit(0); } pid = setsid(); /* break control terminal affiliation */ if (pid == -1) { log("%s: setsid failed--%s\n", progName, ERRMSG); exit(1); } } setProgName(); log("%s: Starting pid %d as daemon\n", progName, getpid()); /* * To make sure we cleanup utmp with atexit if we're aborted */ chp = (char *) posignal(SIGINT, sigHandler); if (chp == (char *) SIG_ERR) { log("%s: sigaction SIGINT failed--%s\n", progName, ERRMSG); return 1; } chp = (char *) posignal(SIGTERM, sigHandler); if (chp == (char *) SIG_ERR) { log("%s: sigaction SIGTERM failed--%s\n", progName, ERRMSG); return 1; } chp = (char *) posignal(SIGHUP, sigHandler); if (chp == (char *) SIG_ERR) { log("%s: sigaction SIGHUP failed--%s\n", progName, ERRMSG); return 1; } sfd = openServer(sport, rhostName, sizeof rhostName, &rport, !debug); if (sfd < 0) { log("%s: open network port %d failed--%s\n", progName, sport, ERRMSG); return 1; } if (verbose) { log("%s: connect from %s:%u\n", progName, rhostName, rport); } key = challenge(sfd, passPhrase, loginTimeout); if (key == (keyType) 0) { log("%s: BADLOGIN %s:%u\n", progName, rhostName, rport); exit(1); } memset(passPhrase, '\0', PHRASE_SIZE); destroyKey(&key); res = write(sfd, PROTOCOL_VERS, strlen(PROTOCOL_VERS)+1); if (res < 0) { log("%s: write (protover) failed--%s\n", progName, ERRMSG); exit(1); } count = getString(sfd, protover, (sizeof protover) - 1, SETUP_TIMEOUT); if (count == 0) { log("%s: NOVERSION %s:%d\n", progName, rhostName, rport); exit(1); } if (protover[0] != PROTOCOL_VERS[0]) { log("%s: BADPROTO(%s) %s:%d\n", progName, protover, rhostName, rport); exit(1); } count = getString(sfd, hostName, (sizeof hostName) - 1, SETUP_TIMEOUT); if (count <= 0) { log("%s: NOHOST %s:%d\n", progName, rhostName, rport); return 1; } if (verbose) { log("%s: requested host:\"%s\"\n", progName, hostName); } count = getString(sfd, aport, (sizeof aport) - 1, SETUP_TIMEOUT); if (count <= 0) { log("%s: NOPORT %s:%u\n", progName, rhostName, rport); return 1; } if (verbose) { log("%s: requested port:\"%s\"\n", progName, aport); } count = sscanf(aport, "%u", &dport); if (count != 1) { log("%s: BADPORT \"%s\" %s:%u \"%s\"\n", progName, aport, rhostName, rport); return 1; } if (verbose) { log("%s: openClient %s:%d\n", progName, hostName, dport); } dfd = openClient(hostName, dport); if (dfd < 0) { log("%s: NOCLIENT %s:%u -> %s:%u\n", progName, rhostName, rport, hostName, dport); return 1; } log("%s: LOGIN %s:%u -> %s:%u\n", progName, rhostName, rport, hostName, dport); res = txfr(dfd, sfd, sfd, bufSize, 0, (keyType) 0); log("%s: LOGOUT %s:%u -> %s:%u\n", progName, rhostName, rport, hostName, dport); /* * Reap all terminated children so we don't leave zombie processes * and make sure our child CPU times are updated. Waitpid returns * -1 when all children have been reaped, and 0 if still have * unterminated children. */ do { pid = waitpid(-1, &chldStat, WNOHANG); if (debug) { log("%s: waitpid returned %d\n", progName, pid); } } while (pid > 0); return 0; } ); log("%s: LOGOUT %s:%u -> %s:%u\n", progName, rhostName, rport, hostName, dport); /* * Reap all terminated children so we don't leave zombie processes * and make sure our child CPU times are updated. Waitpid returdeslogin-1.3/log.c000044400001450000013000000157620572743274600151740ustar00barrettsystem00000000000000/* * @(#) log.c RCS: $Revision: 1.6 $ $Date: 95/03/08 15:54:50 $ * * Logging facility * * #define _USE_SYSLOG if you want to use logging via a socket to syslogd * instead of logging to a file. I don't trust syslog's socket to be secure, * so I don't use syslog; Your needs may be different. Also, syslog does * a fork(), making life even more complex. */ #define _POSIX_SOURCE #include /* close write _exit */ #include /* atexit */ #include #include #include /* S_IRUSR S_IWUSR */ #include /* O_RDWR */ #include /* strerror strlen for braindamaged vsprintf */ #include /* errno */ #include /* time() localtime() strftime() struct tms */ #include /* uname() struct utsname */ #if defined(_USE_SYSLOG) #include #endif #include "log.h" #if (defined(sparc) || defined(sun3)) && !defined(__SOLARIS__) #define atexit on_exit #endif #define SYSLOG_FD 32767 /* run-time value to enable syslog */ #define LOGBUFSIZ BUFSIZ /* POSIX2 may have a better value */ static int logFd = 2; /* stderr */ static char logBuf[LOGBUFSIZ]; static int logOpen = 0; /* non-zero if openLog has ever been successful */ static char *syslogId = ""; /* long-lived storage */ extern char *progName; /* * Close the log file if it's open. Don't do anything if openLog has * never been called. Shut down syslog if it was a syslog connection. */ void closeLog() { if (logOpen) { /* only close a log if it is open */ if (logFd == SYSLOG_FD) { #if defined(_USE_SYSLOG) /* to allow machines w/o syslog */ closelog(); #endif logFd = -1; } if (logFd >= 0) { close(logFd); } logFd = -1; logOpen = 0; } } /* * Open the specified log file. If the open fails, the existing logfile * remains unchanged; if called multiple times on same log, works correctly. * the log() function acts like fprintf(stderr,...) until the first successful * call to openLog(), after which it formats like syslog(). */ int openLog(fname) char *fname; { register int newlog = SYSLOG_FD; /* default is success */ #if defined(_USE_SYSLOG) if (logFd != SYSLOG_FD) { /* I don't trust syslog to reopen OK */ #if !defined(__bsdi__) && !defined(linux) /* * Return value is not documented in BSD brick. * * BSD is braindamaged: How do you detect failure? it can definitely fail * (It often forks and opens a TCP socket to a remote machine.) * God only knows what BSD does if you call openlog twice; do you? * If so, please send mail to the author, so I can fix this code properly. * If your host is one of the ones that does't return a result, add * "|| !defined(__mymachine) above and add a -D__mymachine to CFLAGS. * * The following machines do have a return value for syslog: * HP-UX * DEC Alpha OSF1 * * I've been told that BSDI's BSD/386 doesn't. */ newlog = #endif openlog(syslogId, LOG_NDELAY|LOG_NOWAIT, LOG_AUTH); /* * We must open the log connection immediately (NDELAY) so that we don't * use file descriptors 0,1, or 2 for the log connection fd. */ if (newlog >= 0) { newlog = SYSLOG_FD; /* a value to signal syslog is being used */ } } #else newlog = open(fname, O_CREAT|O_APPEND|O_WRONLY|O_NOCTTY, S_IRUSR|S_IWUSR); #endif if (newlog < 0) { return -1; } if (logFd != SYSLOG_FD) { closeLog(); } logFd = newlog; logOpen = 1; newlog = atexit(closeLog); /* close log file upon exit */ return 0; } /* * Get the local host name (not the domain name!) * * A bombproof version of BSD's gethostname, which always succeeds and * has a sensible return value. * * returns in the array hostName the '\0' terminated name of the local host. * The size argument specifies space (in bytes) available. * Returns the number of characters stored not including the '\0'. * If the host cannot be determined, 0 is returned. * The array returned is always '\0'-terminated except if size is 0. * Only the characters before the first dot '.' character are returned. * * Returns: the number of characters stored (not including the final '\0'); */ static size_t getHostName(hostName, size) register char *hostName; register size_t size; { struct utsname hstats; register char *chp; int res; register size_t i = 0; res = uname(&hstats); if ((res >= 0) && size) { chp = hstats.nodename; --size; if (size) do { if ((*chp == '.') || (*chp == '\0')) { break; } *hostName++ = *chp++; i++; } while (--size); *hostName = '\0'; } return i; } #if !defined(__STDC__) /* { */ #include void log(va_alist) va_dcl #else /* } { */ #include #if defined(__STDC__) || defined(__cplusplus) /* { */ void log(char *fmt, ...) #else /* } { */ void log(fmt) char *fmt; #endif /* } */ #endif /* } */ { size_t count = 0; int ok = 1; char *chp = logBuf; time_t now = time((time_t *)0); va_list args; #if !defined(__STDC__) /* { */ char *fmt; va_start(args); fmt = va_arg(args, char *); #else /* } { */ va_start(args , fmt); #endif /* } */ if (logFd != -1) { /* do nothing if log fd not valid */ if (logOpen && (logFd != SYSLOG_FD)) { /* * Prepend the date time, and hostname like syslog does. */ /* strftime is in for ANSI C */ count = strftime(chp, 64, "%b %d %H:%M:%S ", localtime(&now)); chp += count; count = getHostName(chp, 64); chp += count; if (count != 0) { *chp++ = ' '; *chp = '\0'; } if (chp != logBuf) { *chp++ = ':'; *chp++ = ' '; *chp = '\0'; } } count = vsprintf(chp, fmt, args); /* * If you get a compiler warning on the vsprintf line stating * pointer to int conversion, you're in big trouble. This * attempts to "fix" the braindamage. * * ANSI C states vsprintf returns the character count. * Some BSD machines (even when compiled with ANSI compilers!) * return a pointer to the first argument instead. */ if (((char *) count) == chp) { while (*chp != '\0') { chp++; } } else { chp += count; } count = chp - &logBuf[0]; if (count > 0) { /* if log message not empty */ /* * This is a kludge for now. Posix 2 has a constant LINE_MAX which * may solve this problem. Unfortunately, I don't have a copy of * the posix 2 standard. */ if (count > LOGBUFSIZ) { count = 37; /* length of message below + 1 for the '\0' */ memcpy(logBuf, "PANIC! log.c:log() buffer overflow!\n", count); ok = 0; } if (logFd == SYSLOG_FD) { #if defined(_USE_SYSLOG) syslog(LOG_INFO, "%-.*s", count, logBuf); #endif } else { /* Use write here instead of stdio to make atomic updates */ write(logFd, logBuf, count); } if (!ok) { closeLog(); _exit(1); } } } va_end(args); } * the posix 2deslogin-1.3/pty.c000044400001450000013000000230250572742124500152060ustar00barrettsystem00000000000000/* * Interface to BSD-style (SYSV-style if -D_USE_STREAMS) Pseudo-ttys. * * You may want to lookup the pty ioctl's: * * HP-UX Only!: * TIOCTRAP - (disabled default) => no exceptional selects will happen. * = enabled => select detects open and close * slave hangs on open or ioctl until master acks. * non-termio ioctl's detected. * termio ioctl's detected if TIOCTTY disabled. * TIOCTTY - enabled => termio ioctl's valid on slave * termio ioctl's detected only if TIOCMONITOR * - disabled => TIOCTRAP detects termio ioctl's. * TIOCMONITOR - enabled => termio ioctls detected if TIOCTRAP & TIOCTTY * * if TIOCTRAP is enabled, then traps must be ack'd by a TIOCREQCHECK, * TIOCREQSET pair in sequence. * * TIOCSIGMODE - TIOCSIGBLOCK - Caught Slave signals are posponed on ioctl * TIOCSIGABORT - All slave signals return EINTR on ioctl * TIOSIGNORMAL - default, restarted requests => a new ioctl * * None of the above exists on any BSD implemenation I can find. Some mention * is made of setting B0 baudrate causing the master to see a close. */ #undef _POSIX_SOURCE /* this is definitely *not* posix source */ #include /* open close */ #include /* free malloc */ #include #include /* strerror */ #include /* errno */ #include #if defined(DGUX) #define _USE_STREAMS #endif #if defined(_USE_STREAMS) #include #include /* I_PUSH I_FIND */ #endif #if defined(__sgi) && !defined(_USE_STREAMS) #include #include /* S_IRUSR S_IWUSR */ #endif #include "pty.h" #include "log.h" #if defined(_USE_STREAMS) /* { */ #define MASTER_PTY "/dev/ptmx" /* __ALPHA __SOLARIS__ DGUX */ #define SLAVE_PTY "/dev/pts/n" /* __ALPHA n = 0,1,...,47 */ #define PTY_STREAM "ptem" /* see ptem(7) */ #define LDIS_STREAM "ldterm" /* SYSV line discipline */ #define COMPAT_STREAM "ttycompat" /* tty compatability stream */ #if defined(_OSF_SOURCE) #undef LDIS_STREAM #define LDIS_STREAM 0 /* OSF1 includes line discipline */ #endif #if defined(__SOLARIS__) /* { */ #undef COMPAT_STREAM #define COMPAT_STREAM 0 /* no tty compatability stream reqd */ /* * gcc gives an error on using ptsname. The man page is ambiguous. */ #if defined(__STDC__) || defined(__cplusplus) extern char *ptsname(int); /* ptsname.3c says in stdio.h; isn't */ #else extern char *ptsname(); #endif #endif /* } __SOLARIS__ */ #if defined(__sgi) #undef MASTER_PTY #define MASTER_PTY "/dev/ptc" #undef SLAVE_PTY #define SLAVE_PTY "/dev/ttyqn" /* tty[q-z][0-99] */ #endif #endif /* } _USE_STREAMS */ #if !defined(MASTER_PTY) /* { */ #if defined(__UNICOS__) /* { */ #define MASTER_PTY "/dev/pty/0xx" /* 0-132 */ #define SLAVE_PTY "/dev/ttyp0xx" /* still incorrect. */ #endif/* } UNICOS */ #if defined(__sgi) /* { IRIX */ #define MASTER_PTY "/dev/ptc" /* /dev/ptc==/dev/ptmx /dev/ptc[1234] */ #define SLAVE_PTY "/dev/pts/n" /* n = 0,1,...,12 */ /* IRIX man page also says: /dev/tty[qrstuvwxyz][0-99] */ #endif /* } __sgi */ #endif /* } !MASTER_PTY */ #if !defined(MASTER_PTY) #define USE_DEFAULT #define MASTER_PTY "/dev/ptyxx" #endif #if !defined(SLAVE_PTY) #define SLAVE_PTY "/dev/ttyxx" #endif static char defSlave[] = SLAVE_PTY; static char defMaster[] = MASTER_PTY; static char ptynum[] = "0123456789abcdef"; static char ptylet[] = "pqrs"; #define LOC ((sizeof defMaster) - 2) /* index of last character */ extern int debug; extern char *progName; #if defined(_USE_STREAMS) /* { */ int pushStream(fd, module) int fd; char *module; { int res; if (module != (char *) 0) { res = ioctl(fd, I_FIND, module); /* see streamio(7) sys/stropt.h */ if (res < 0) { log("%s: ioctl(%d, I_FIND, \"%s\") failed--%s\n", progName, fd, module, ERRMSG); close(fd); return -1; } if (res == 0) { /* module not already pushed */ res = ioctl(fd, I_PUSH, module); if (res < 0) { log("%s: pushStream(%d, \"%s\") failed--%s\n", progName, fd, module, ERRMSG); close(fd); return -1; } } } return fd; } #endif /* } */ /* * This funcion is necessary so that re-open's of the slave pty can * make sure to initialize it correctly on some machines which will lose * it if the slave is closed and reopened again. */ int openSlavePty(sname, mode) char *sname; int mode; { int res, fd = open(sname, mode, 0); if (fd < 0) { log("%s: openSlavePty(\"%s\", 0%o) failed--%s\n", progName, sname, mode, ERRMSG); return -1; } #if defined(_USE_STREAMS) /* { */ fd = pushStream(fd, PTY_STREAM); if (fd >= 0) { fd = pushStream(fd, LDIS_STREAM); if (fd >= 0) { fd = pushStream(fd, COMPAT_STREAM); } } #endif /* } _USE_STREAMS */ return fd; } /* * Find an available unused pty. Open the master side and slave side. * Return the fd and names for the master and slave sides. * * The reasons you must open the slave are: * - The open must be atomic to opening the master to prevent another * process from grabbing the slave and stealing control. * * - The slave open may be impossible because of permissions. The slave * pty changes ownership when login processes grab it. * * This can cause problems because the slave could become the new controlling * terminal for this process under certain conditions. * HP-UX9.0:pty(7)manPage: * * The slave side of the pty interprets opening or closing the master * side as a modem connection or disconnection on a real terminal. Only * one open to the master side of a pty is permitted. An attempt to open * an already open master side returns -1 and sets the external variable * errno to EBUSY. An attempt to open the master side of a pty that has * a slave with an open file descriptor returns -1 and sets errno to * EBUSY...An ioctl() request made on the slave side of a pty after * the master side is closed returns -1 and sets the external variable * errno to EIO. * * Ultrix:pty(4): The slave device can be opened multiple times, while the * master half can be opened only once. * * Thus, at the instant the open succeeds, we are guarenteed that the slave * side was not open by any other process, and we are the exclusive holder * of the open fd for the master side. * * Two questions remain: What happens if a read occurs on the master * before any process has opened the slave? and, how can the master prevent * multiple opens on the slave? On my machine, the only thing that prevents * a sufficiently determined process from opening the slave (even if it's * already open by another process as the controlling terminal) is the * permissions on the slave pty filename. * * The DEC alpha provides an openpty(3) and forkpty(3) call, but they are not * available on HP-UX or Ultrix. SGI IRIX provides something called _getpty. * * Actually, the slave opening code is not really required. All we want to do * is make sure that the slave has the correct permisisons. */ int openPty(mode, slaveName, masterName, size, slaveFd) int mode; char *slaveName, *masterName; unsigned size; int *slaveFd; { register char *letp = ptylet, *nump; char *sname = defSlave, *mname = defMaster; int fd = -1, res; #if defined(__SOLARIS__) || defined(DGUX) /* { */ fd = open(mname, mode); if (debug > 1) { log("%s: open(\"%s\", 0%o) returned %d\n", progName, mname, mode, fd); } if (fd >= 0) { /* grantpt does chmod(mfd, 0620); chown(mfd, geteuid()), via a fork. * Failure of grantpt is not usually fatal; if we're root already * then we'll do it later explicitly anyway */ res = grantpt(fd); if (debug > 1) { log("%s: grantpt(%d) returned %d\n", progName, fd, res); } res = unlockpt(fd); /* clear lock on slave w/master fd for open() */ if (debug > 1) { log("%s: unlockpt(%d) returned %d\n", progName, fd, res); } if (res < 0) goto ptyFail; sname = ptsname(fd); /* "/dev/pts/N", N = non-negative int */ if (sname == 0) { log("%s: ptsname(%d) failed--%s\n", progName, fd); goto ptyFail; } if (debug > 1) { log("%s: ptsname(%d) returned \"%s\"\n", progName, fd, sname); } if (slaveFd != (int *) 0) { *slaveFd = openSlavePty(sname, mode); if (*slaveFd < 0) goto ptyFail; } } #endif /* } __SOLARIS__ || DGUX */ #if defined(__sgi) && !defined(_USE_STREAMS) /* { */ sname = _getpty(&fd, mode, S_IRUSR | S_IWUSR | S_IWGRP, 1); if (sname == 0) { log("%s: _getpty(&fd, %o, %o, 1) failed--%s\n", progName, mode, S_IRUSR | S_IWUSR | S_IWGRP, ERRMSG); goto ptyFail; } if (slaveFd != (int *) 0) { *slaveFd = openSlavePty(sname, mode); if (*slaveFd <= 0) goto ptyFail; } #endif /* } __sgi */ #if defined(USE_DEFAULT) /* { */ do { mname[LOC-1] = sname[LOC-1] = *letp; nump = ptynum; do { mname[LOC] = sname[LOC] = *nump; fd = open(mname, mode, 0); if (fd >= 0) { if (slaveFd == (int *) 0) goto gotPty; *slaveFd = openSlavePty(sname, mode); if (*slaveFd >= 0) goto gotPty; close(fd); fd = -1; } } while (*++nump != '\0'); } while (*++letp != '\0'); #endif /* } USE_DEFAULT */ gotPty: if (fd >= 0) { if (masterName != (char *) 0) { strncpy(masterName, mname, size); } if (slaveName != (char *) 0) { strncpy(slaveName, sname, size); } } ptyRtn: return fd; ptyFail: close(fd); fd = -1; goto ptyRtn; } if (slaveFd == (int *) 0) goto gotPty; *slaveFd = openSlavePty(sname, mode); if (*slaveFd >= 0) goto gotPty; close(fd); fd = -1; } } while (*++nump != '\0'); } while (*++letp != '\0'); #endif /* } USE_DEFAULT */ gotPty: if (fd >= 0) { if (masterName != (char *) 0) { strncpy(masterName, mname, size); } if (slaveName != (char *) 0) { strncpy(slaveName, sname, size); } } ptyRtn: return fd; ptyFail: close(fd); fd = -deslogin-1.3/socket.c000044400001450000013000000271430572542153100156630ustar00barrettsystem00000000000000/* * @(#) socket.c RCS: $Revision: 1.6 $ $Date: 95/03/02 12:54:08 $ * * Socket operations * * getLocalAddr - no error reporting * getRemoteAddr - no error reporting * openClient - reports error * openServer - reports error */ #if defined(_POSIX_SOURCE) #undef _POSIX_SOURCE /* see comment below */ #endif #include /* pid_t */ /* * errno.h must not be _POSIX_SOURCE in BSDI's BSDI/386 or ENOTSOCK not defined */ #include /* EINTR ENOTSOCK */ /* * These symbols are defined in but not if _POSIX_SOURCE * * Some machines can cause them to be defined by: * DEC/OSF1 - #define _OSF_SOURCE * HP-UX - #define _HPUX_SOURCE - must still do this for other declarations * SunOS 4.1 - not possible, that's why we put them here. */ #if 0 typedef unsigned char u_char; /* */ typedef unsigned short u_short; /* */ typedef unsigned long u_long; /* */ typedef unsigned int u_int; /* and DEC OSF/1 */ #endif /* #define _POSIX_SOURCE /* This isn't posix source */ #include /* struct sockaddr */ /* connect accept listen bind socket */ /* getpeername getsockname */ #include #include /* TCP_NODELAY */ #include /* gethostbyaddr */ #include /* inet_ntoa on mips and hpux */ #include /* close waitpid */ #include /* atexit */ #include #include #include #include /* WNOHANG */ #include "log.h" #include "socket.h" #include "deslogin.h" #include "posignal.h" #if defined(TERM_LINK) /* { */ /* * When using a dialup line to a non-slip capable terminal server, there * is a package which allows you to multiplex the serial line. See * sunsite.unc.edu:/pub/Linux/apps/comm/term/term/term117.tar.gz for details. */ #include #endif /* } */ /* * Return a non-zero socket type of the specifed fd if it is a socket * 0 otherwise, -1 for failure * * socket types in : (socket types always > 0) * SOCK_STREAM SOCK_DGRAM SOCK_RAW SOCK_RDM SOCK_SEQPACKET */ int socktype(fd) int fd; { int sotype = -1; int size = sizeof sotype; int res; res = getsockopt(fd, SOL_SOCKET, SO_TYPE, (void *) &sotype, &size); if (res >= 0) { res = sotype; } else if (errno == ENOTSOCK) { res = 0; } return res; } /* * If flag non-zero, enable TCP delays * * Returns: * 1 delay was previously enabled * 0 delay was previously disabled * -1 if gotprotobyname for "tcp" failed * -2 if getsockopt TCP_NODELAY failed * -3 if setsockopt TCP_NODELAY failed */ int tcpDelay(sock, flag) int sock, flag; { struct protoent *pent; int newflag = -1, oldflag = -1; int newlen = sizeof newflag, oldlen = sizeof oldflag; int tcplevel, res; flag = !flag; /* NODELAY is opposate sense */ pent = getprotobyname("tcp"); if (pent == (struct protoent *) 0) { /* opens file /etc/protocols */ return -1; } tcplevel = pent->p_proto; /* protocol number for tcp */ res = getsockopt(sock, tcplevel, TCP_NODELAY, (void *) &oldflag, &oldlen); if (res == 0) { oldflag = !oldflag; /* 4 for TCP_NODELAY on, 0 for OFF */ } else { if (errno == ENOPROTOOPT) { /* never happens on hpux */ oldflag = 1; /* NODELAY was disabled */ } else { return -2; } } res = setsockopt(sock, tcplevel, TCP_NODELAY, (void *) &flag, sizeof flag); if (res != 0) { return -3; } /* * To detect new state when in debugger */ res = getsockopt(sock, tcplevel, TCP_NODELAY, (void *) &newflag, &newlen); return oldflag; } /* * Lookup the specified network address (from accept for example). * Returns (char *) 0 for failure. */ char *hostAddrToName(addr, name, namelen) struct sockaddr_in *addr; /* address from accept(2) */ char *name; /* where to put hostname */ unsigned namelen; /* how many bytes are there for it */ { struct hostent *hp = gethostbyaddr( (char *) &(addr->sin_addr), sizeof addr->sin_addr, addr->sin_family); if (hp == (struct hostent *) 0) { return (char *) 0; } if (name != (char *) 0) { strncpy(name, hp->h_name, namelen); } return name; } /* * Internal: convert address to string and port * * Returns: * -1 - if hostname not found (string contains internet address) * 0 - if hostname found and copied */ int mapAddr(iaddr, hostName, size, port) struct sockaddr_in *iaddr; char *hostName; unsigned size; unsigned *port; { char *chp; int res = 0; chp = hostAddrToName(iaddr, hostName, size); if (chp == (char *) 0) { if (hostName != (char *) 0) { strncpy(hostName, inet_ntoa(iaddr->sin_addr), size); } res = -1; } if (port != (unsigned *) 0) { *port = (unsigned) ntohs(iaddr->sin_port); } return res; } /* * Find the address for the specified host and port (AF_INET only). * * Input; addr, size location and size of whereto put the result * port which port number to use * * Output: addr - the address * Returns: The sizeof the area used by addr, or -1 if error */ int hostNameToAddr(addr, size, name, port) struct sockaddr *addr; unsigned size; char *name; int port; { struct hostent *hp = gethostbyname(name); struct sockaddr_in *iaddr = (struct sockaddr_in *) addr; int res = -1; if (hp != (struct hostent *) 0) { memset(addr, '\0', size); iaddr->sin_family = hp->h_addrtype; if (hp->h_addrtype == AF_INET) { if ((char *) &iaddr->sin_addr + hp->h_length <= (char *) iaddr + size) { memcpy(&iaddr->sin_addr, hp->h_addr, hp->h_length); iaddr->sin_port = htons(port); } res = sizeof (struct sockaddr_in); } } return res; } /* * Try to find the local address of the specified socket. * * Returns: * 0 - success * ENOTSOCK - if not a socket * errno - if other error */ int getLocalAddr(sock, hostName, size, port) int sock; char *hostName; unsigned size; unsigned *port; { int res; struct sockaddr_in iaddr; int addrlen; addrlen = sizeof iaddr; res = getsockname(sock, (struct sockaddr *) &iaddr, &addrlen); if (res < 0) { return errno; } res = mapAddr(&iaddr, hostName, size, port); return 0; } /* * Try to find the remote address of the specified socket. * * Returns: * 0 - success * ENOTSOCK - if not a socket * errno - if other error */ int getRemoteAddr(sock, hostName, size, port) int sock; char *hostName; unsigned size; unsigned *port; { int res; struct sockaddr_in iaddr; int addrlen; addrlen = sizeof iaddr; res = getpeername(sock, (struct sockaddr *) &iaddr, &addrlen); if (res < 0) { return errno; } res = mapAddr(&iaddr, hostName, size, port); return 0; } /* * Return the port number for the specified service name or -1 if failed */ int getServicePort(name) char *name; { struct servent *sent; int res = -1; sent = getservbyname(name, (char *) 0); if (sent != (struct servent *) 0) { res = ntohs(sent->s_port); } return res; } void sockHandler(sig) int sig; { if (debug) { log("%s(openServer): SIGCHLD\n", progName); } } /* * Listen for a TCP connection on the specified port. Return socket to it. * If hostname is non-null, return upto size bytes of remote host's name. * If rport is non-null, set it to the remote port. * * The caller of this routine should catch SIGCHLD using POSIX sigaction call * (see posignal.c) so that we can reap unwanted children when they die. * * Reports Error if failure and returns -1; othewise the socket */ int openServer(port, hostName, size, rport, serverflag) int port; char *hostName; unsigned size; unsigned *rport; int serverflag; /* 1 if server, 0 if only once */ { int lsock, csock = -1, caddrLen, res; pid_t pid; struct sockaddr_in laddr, caddr; pid_t child = 0; pfv oldHandler; lsock = socket(AF_INET, SOCK_STREAM, 0); if (lsock < 0) { log("%s: stream socket create failed--%s\n", progName, ERRMSG); return -1; } memset(&laddr, '\0', sizeof laddr); laddr.sin_family = AF_INET; laddr.sin_addr.s_addr = htonl(INADDR_ANY); laddr.sin_port = htons(port); res = bind(lsock, (void *) &laddr, sizeof laddr); if (res < 0) { log("%s: bind to port %d failed --%s\n", progName, port, ERRMSG); return -1; } res = listen(lsock, 2); if (res < 0) { log("%s: listen failed --%s\n", progName, ERRMSG); return -1; } oldHandler = posignal(SIGCHLD, sockHandler); if (oldHandler == (pfv) -1) { if (oldHandler == (pfv) -1) { log("%s(openServer): sigaction SIGCHLD failed--%s\n", progName, ERRMSG); return -1; } } do { if (csock >= 0) { close(csock); } /* * Block until we receive a connect request. */ caddrLen = sizeof caddr; memset(&caddr, '\0', sizeof caddr); csock = accept(lsock, (void *) &caddr, &caddrLen); if (csock < 0) { if (errno != EINTR) { log("%s: accept call failed--%s\n", progName, ERRMSG); exit(1); } /* SIGCHLD: Reap all children so we don't leave zombie processes. */ do { pid = waitpid(-1, (int *) 0, WNOHANG); } while (pid > 0); } else { if (serverflag) { child = fork(); } } } while (serverflag && child > 0); posignal(SIGCHLD, oldHandler); close(lsock); if (debug) { log("%s: accept from %s:%u\n", progName, inet_ntoa(caddr.sin_addr), ntohs(caddr.sin_port)); } if (child < 0) { log("%s: openServer: fork of child failed\n", progName); exit(1); } res = tcpDelay(csock, 1); /* don't delay TCP transmissions */ if (res < 0) { log("%s: tcpDelay returned (%d) --%s\n", progName, res, ERRMSG); /* OK to continue */ } res = mapAddr(&caddr, hostName, size, rport); return csock; } /* * Establish a connection to the remote host and port. * * Return -1 for failure (error reported) */ int openClient(hostName, port) char *hostName; int port; { int sock, res; #if !defined(TERM_LINK) /* { */ struct sockaddr addr; int addrLen; addrLen = hostNameToAddr(&addr, sizeof addr, hostName, port); if (addrLen < 0) { log("%s: can't find address for host \"%s\"\n", progName, hostName, ERRMSG); return -1; } sock = socket(addr.sa_family, SOCK_STREAM, 0); if (sock < 0) { log("%s: stream socket create failed--%s\n", progName, ERRMSG); return -1; } res = connect(sock, (struct sockaddr *) &addr, addrLen); if (res < 0) { log("%s: connect to %s:%d failed--%s\n", progName, hostName, port, ERRMSG); return -1; } #if 0 /* BSD removed this and replaced with struct linger. */ res = setsockopt(sock, SOL_SOCKET, SO_DONTLINGER, (char *) 0, 0); #endif res = tcpDelay(sock, 1); /* don't delay TCP transmissions */ if (res < 0) { log("%s: tcpDelay returned (%d) --%s\n", progName, res, ERRMSG); /* OK to continue */ } #else /* } { TERMLINK */ sock = connect_server(0); if (sock < 0) { log("%s: connect to term server failed\n", progName); return -1; } res = send_command(sock, C_PORT, 0, "%s:%u", hostName, port); if (res < 0) { log("%s: send_command(%u, C_PORT, 0 \"%s:%u\") failed--%s\n", progName, sock, hostName, port, command_result); return -1; } res = send_command(sock, C_DUMB, 1, 0); if (res < 0) { log("%s: send_command(%u, C_DUMB) failed--%s\n", progName, sock, command_result); return -1; } #endif /* } TERMLINK */ return sock; } %s: connect to term server failed\n", progName); return -1; } res = send_command(sock, C_PORT, 0, "%s:%u", hostName, port); if (res < 0) { log("%s: send_command(%u, C_PORT, 0 \"%s:%u\") failed--%s\n", progName, sock, hostName, port, command_result); return -1; } res = send_command(sock, C_DUMB, 1, 0); if (res < 0) { log("%s: send_command(%u, C_DUMB) failed--%s\n", deslogin-1.3/txfr.c000044400001450000013000000403530572743274700153710ustar00barrettsystem00000000000000/* * @(#) txfr.c RCS: $Revision: 1.8 $ $Date: 95/03/08 15:46:54 $ */ #if defined(_POSIX_SOURCE) #undef _POSIX_SOURCE /* otherwise won't define fd_set */ #endif #include /* BSD type fd_set FD_SET macros */ #include /* BSD struct timeval */ #if !defined(_POSIX_SOURCE) /* in case the above include files defined it */ #define _POSIX_SOURCE /* yes, I know posix doesn't have select */ #endif #include /* alarm read write */ #include /* exit malloc */ #include #include /* EINTR EAGAIN */ #include /* SIGCHLD */ #include /* memset */ #include /* O_NONBLOCK */ #include /* select */ /* * 25-Jan-95: gl8f@fermi.clas.virginia.edu (Greg Lindahl) * 25-Jan-95: skrenta@pbm.com (Rich Skrent) */ #if defined(AIX) || defined(__DYNIX__) /* { */ #include /* AIX 3.2.5 mainframe */ #endif /* } */ #include "posignal.h" #include "log.h" #include "auth.h" #include "txfr.h" #include "deslogin.h" extern unsigned long inBytes, outBytes; #if !defined(WRITE_RETRY_TIME) #define WRITE_RETRY_TIME 1000 /* ms retry time on EAGAIN for write */ #endif #if !defined(sparc) && !defined(sun3) volatile #endif unsigned gotalarm = 0; /* * In POSIX, the read or write call will be interrupted by a signal. If so, * the read may return with -1 and errno=EINTR, or, if multi-byte, may return * a result of the number of bytes read. */ void alarmCatcher(sig) int sig; { gotalarm++; } #if !defined(sparc) && !defined(sun3) volatile #endif unsigned txfrChld = 0; void chldCatcher(sig) int sig; { txfrChld++; if (debug) { log("%s: (txfr) SIGCHLD #%d\n", progName, txfrChld); } } int recvData(fd, buf, size, cbuf, cs) int fd; char *buf, *cbuf; unsigned size; register cipherKey cs; { register int rcount = read(fd, cbuf, size); if (debug > 2) { log("read(%d,%d)=%d(%d)\n", fd, size, rcount, errno); } if (rcount <= 0) { /* * Linux (and some other machines) always emit this message with * errno "I/O error" when the connection is shut down correctly. */ if ((rcount < 0) && ((verbose) || (debug))) { log("%s: (recv) read %d bytes fd %d failed--%s\n", progName, size, fd, ERRMSG); } return rcount; } cipherData(buf, cbuf, rcount, cs); return rcount; } int sendData(fd, buf, size) int fd; char *buf; unsigned size; { int wcount; wcount = write(fd, buf, size); if (debug > 2) { log("write(%d,%d)=%d(%d)\n", fd, size, wcount, errno); } /* * We could get -1 and EAGAIN if a write is attempted for less than * fpathconf(_PC_PIPE_BUF) and there isn't space yet. In this case, * if we just returned immediately, we could chew up a lot of CPU time * with select continually returning true. Gag! Just pause for a * WRITE_RETRY_TIME and return. */ if (wcount == 0) { log("%s: (send) write %d bytes fd %d returned 0\n", progName, size, fd); exit(1); } if (wcount < 0) { if (errno != EAGAIN) { log("%s: (send) write %d bytes fd %d failed--%s\n", progName, size, fd, ERRMSG); exit(1); } if (debug || verbose) { log("%s: (send) write %d bytes fd %d busy; Retry in %lu msec\n", progName, size, fd, WRITE_RETRY_TIME); } wcount = nap(WRITE_RETRY_TIME); if (wcount != 0) { log("%s: (send) nap(%lu) failed--%s\n", progName, WRITE_RETRY_TIME, ERRMSG); exit(1); } } return wcount; } /* * Set the nonblocking flag for the given fd with error report. * returns the previous nonblock flag or -1 for falure (exits). */ int setnonblock(fd, flag) int fd, flag; { int res, oldflag; oldflag = fcntl(fd, F_GETFL); if (oldflag < 0) { log("%s: (setnonblock) fcntl(%d) F_GETFL failed--%s\n", progName, fd, ERRMSG); exit(1); } if (flag) { res = fcntl(fd, F_SETFL, oldflag | O_NONBLOCK); } else { res = fcntl(fd, F_SETFL, oldflag & ~O_NONBLOCK); } if (res < 0) { log("%s: (setnonblock) fcntl(%d) F_SETFL failed--%s\n", progName, fd, ERRMSG); exit(1); } return ((oldflag & O_NONBLOCK) == O_NONBLOCK); } /* * Sleep for a specified number of milliseconds * * Returns: 0 if successful, -1 if unsuccessful */ int nap(ms) unsigned long ms; { struct timeval to; register int res; to.tv_sec = ms / 1000; to.tv_usec = (ms % 1000) * 1000; res = select(0, 0, 0, 0, &to); /* wait a short while */ return res; } /* * Select on the master pty before the slave has a successful open behaves * totally differently on every machine I tried. There appears to be no * machine independent way to do both of the following: * * 1) Determine when the slave has been opened * 2) Prevent multiple processes from opening the slave. * * If there was a way to do 2, what we should *really* do is to do a full * bore authentication protocal between the slave and tha master. Since * there is no way to achieve 2 except file permissions on the slave pty, * there isn't any point; anyone that can break the file permissions can * intercept data between the slave pty and the process using it (which * will be the user shell, so we can't help here. * * On DEC Alpha, select lies and returns true for read on the master pty when * the slave hasn't opened it yet. A subsequent read will fail errno=EIO. * It fails to return true for write at all. * It fails to return true for exception. * * On DEC Ultrix 4.3, select returns true for read on the master pty when * the slave hasn't opened it yet. A subsequent read will fail errno=EIO. * It also returns true for write. * It also returns true for exception. * * Do whatever it takes to make sure that txfr won't abort before the slave * side of the pty has been opened. Because select is so unpredicable before * the slave is open, we have to throw up our hands and poll until we don't * get an I/O error. Since we can't poll transparently we have to have * the process on the slave side send us something with mkReady. * * Returns: 0 - if timeout * 1 - success * <0 - failure (Could be from SIGCHLD) */ int waitReady(fd, buf, size, timeout) int fd; char *buf; unsigned size; unsigned timeout; { pfv oldHandler; struct timeval to; int res = 0; gotalarm = 0; oldHandler = posignal(SIGALRM, alarmCatcher); alarm(timeout / 1000); while (!res && !gotalarm) { res = read(fd, buf, size); if (debug) { log("%s: (waitReady) read=%d gotalarm=%d\n", progName, res, gotalarm); } if (res < 0) { if (errno != EIO) { break; } to.tv_sec = 0; /* some selects update to on return */ to.tv_usec = 500000; /* 500 ms polling interval */ res = select(0, 0, 0, 0, &to); /* wait a short while */ if (gotalarm) { res = 0; /* it was -1 from select being interrupted by signal */ } /* res could still be -1 if SIGCHLD */ } } alarm(0); posignal(SIGALRM, oldHandler); return res; /* res > 0 for success, < 0 failure, 0 timeout */ } int mkReady(fd, buf, size, timeout) int fd; char *buf; unsigned size; unsigned timeout; { pfv oldHandler; struct timeval to; int res = 0; gotalarm = 0; oldHandler = posignal(SIGALRM, alarmCatcher); alarm(timeout / 1000); while (!res && !gotalarm) { res = write(fd, buf, size); if (debug > 1) { log("%s: (mkReady) write=%d gotalarm=%d\n", progName, res, gotalarm); } if (res < 0) { if (errno != EIO) { break; } to.tv_sec = 0; /* some selects update to on return */ to.tv_usec = 500000; /* 500 ms polling interval */ res = select(0, 0, 0, 0, &to); /* wait a short while */ if (gotalarm) { res = 0; /* it was -1 from select being interrupted by signal */ } } } alarm(0); posignal(SIGALRM, oldHandler); return res; /* res > 0 for success, < 0 failure, 0 timeout */ } /* * Transfer data bidirectionally using a buffer of given size. * Returns when timeout (ms) expires (0 = timeout) * or when eof (res = 1) * or error (res = -1); * or interrupt (res = -2) (or exception, slave closed pty) * * NOTE: there appears to be a bug in HP-UX where a read can return EAGAIN * even if select returns true for both read and write on a tty fd. * On the DEC Alpha: * If the slave side of a pty isn't open yet, the master side's select * will return true for read, and the read call will fail with * EIO. */ int txfr(fd1, fdin, fdout, bufSize, timeout, key) int fd1, fdout, fdin; unsigned bufSize; unsigned timeout; keyType key; { char *cbuf = (char *) malloc(bufSize); char *buf1 = (char *) malloc(bufSize); char *bufin = (char *) malloc(bufSize); struct timeval to, tov, *top = (struct timeval *) 0; /* Not POSIX */ unsigned max_fd = fd1; fd_set rmask, wmask, emask; int result = -1, oldblockin = 0, oldblockout = 0, oldblock1 = 0; int fdinEof = 0; cipherKey cs1 = (cipherKey) 0, csin = (cipherKey) 0; pfv oldChld; register int res, rcount1 = 0, rcountin = 0, wcount; register char *bufp1, *bufpin; if (fdout > max_fd) max_fd = fdout; if (fdin > max_fd) max_fd = fdin; if (buf1 == (char *) 0) goto txfr_done; if (bufin == (char *) 0) goto txfr_done; if (cbuf == (char *) 0) goto txfr_done; #if 0 key = (keyType) 0; /* for debug! */ #endif cs1 = mkCipherKey(key, 1); /* decrypt */ csin = mkCipherKey(key, 0); /* encrypt */ if (cs1 == (cipherKey) 0) goto txfr_done; if (csin == (cipherKey) 0) goto txfr_done; bufp1 = buf1; bufpin = bufin; if (timeout != 0) { to.tv_sec = (timeout / 1000); to.tv_usec = (timeout % 1000) * 1000; top = &tov; } /* * We must use non-blocking IO to ensure that write calls won't block. * Read calls are safe anyway. */ oldblock1 = setnonblock(fd1, 1); oldblockin = setnonblock(fdin, 1); /* must be before fdout */ oldblockout = setnonblock(fdout, 1); txfrChld = 0; oldChld = posignal(SIGCHLD, chldCatcher); if (oldChld == (pfv) -1) { log("%s: (txfr) sigaction SIGCHLD failed--%s\n", progName, ERRMSG); exit(1); } FD_ZERO(&emask); do { FD_ZERO(&rmask); FD_ZERO(&wmask); FD_SET(fd1, &emask); #if 0 /* we don't want exception checking on tty or files */ FD_SET(fdout, &emask); FD_SET(fdin, &emask); #endif if (rcount1 != 0) FD_SET(fdout, &wmask); else { FD_SET(fd1, &rmask); } if (rcountin != 0) FD_SET(fd1, &wmask); else if (!fdinEof) { FD_SET(fdin, &rmask); } if (top != (struct timeval *) 0) { tov.tv_sec = to.tv_sec; tov.tv_usec = to.tv_usec; } if (debug > 2) { log("select(%u,%u,%u,%u)\n", max_fd+1, *(unsigned *)&rmask, *(unsigned *)&wmask, *(unsigned *)&emask); } if (txfrChld != 0) { /* must be right next to select */ break; } /* race condition right here */ /* * HP-UX incorrectly declares select with int * args instead of fd_set * Ignore the warnings for select for HP-UX. */ res = select(max_fd+1, &rmask, &wmask, &emask, top); if (debug > 2) { log("select returned: %u(%u,%u,%u)\n", res, *(unsigned *)&rmask, *(unsigned *)&wmask, *(unsigned *)&emask); } if (res == 0) { /* timeout */ result = 0; break; } if (res < 0) { /* error */ if (errno == EINTR) { /* signal (SIGCHLD occurred) */ result = -2; break; } else { log("%s: select failed--%s\n", progName, ERRMSG); break; } } /* * This block will never be triggered because there is no way for a * close on a slave pty to be detected on non-hpux systems. */ if (FD_ISSET(fd1, &emask) #if 0 || FD_ISSET(fdout, &emask) || FD_ISSET(fdin, &emask) #endif ) { /* close */ result = -2; break; } if (FD_ISSET(fd1, &rmask)) { rcount1 = recvData(fd1, buf1, bufSize, cbuf, cs1); if (rcount1 <= 0) { if (rcount1 == 0) { result = 1; break; } else { result = -1; break; } } bufp1 = buf1; inBytes += rcount1; } if (FD_ISSET(fdin, &rmask)) { rcountin = recvData(fdin, bufin, bufSize, cbuf, csin); if (rcountin <= 0) { if (rcountin == 0) { fdinEof = 1; } else { result = -1; break; } } bufpin = bufin; outBytes += rcountin; } if (FD_ISSET(fd1, &wmask)) { wcount = sendData(fd1, bufpin, rcountin); rcountin -= wcount; bufpin += wcount; } if (FD_ISSET(fdout, &wmask)) { wcount = sendData(fdout, bufp1, rcount1); rcount1 -= wcount; bufp1 += wcount; } } while (txfrChld == 0); posignal(SIGCHLD, oldChld); setnonblock(fd1, oldblock1); setnonblock(fdin, oldblockin); /* * We must blindly assume that we don't want non-blocking I/O when whe * leave. The reason is that two fd's may actually be connected to the * same device. If this is the case, then it's possible to switch the * nonblocking mode incorrectly. (e.g. setting NON_BLOCK in fdin also * changes it on fdout) */ setnonblock(fdout, oldblockin); /* oldblockin is not a bug */ txfr_done: destroyCipherKey(&csin); destroyCipherKey(&cs1); free(bufin); free(buf1); free(cbuf); return result; } /* * Input a string of upto size chars with timout terminated by CR LF or NULL * Input: * size - the maximum number of characters to read * * Output: * *buf - The characters read not including terminator * A '\0' character is always added to the end of buf * * Returns: the number of characters read (not including terminator) * This is true even if we were interrupted by an alarm. */ int getString(fd, buf, size, timeout) int fd; char *buf; unsigned size; unsigned timeout; { register unsigned count = size; register char *chp = buf; char ch; register unsigned seconds = (unsigned) ((timeout + (1000L-1)) / 1000L); register int rcount; pfv oldHandler; gotalarm = 0; oldHandler = posignal(SIGALRM, alarmCatcher); alarm(seconds); while (count != 0) { rcount = read(fd, &ch, 1); if (rcount <= 0 || gotalarm != 0) break; if (ch == '\r' || ch == '\n' || ch == '\0') break; *chp = ch; count -= rcount; chp += rcount; } alarm(0); posignal(SIGALRM, oldHandler); *chp = '\0'; return size - count; } /* * Read a block of binary data of the given size. * Return the number of bytes read (0 if timeout, or read error). */ int getBlock(fd, buf, size, timeout) int fd; char *buf; unsigned size; unsigned timeout; { register unsigned seconds = (unsigned) ((timeout + (1000-1)) / 1000); register int rcount; pfv oldHandler; gotalarm = 0; oldHandler = posignal(SIGALRM, alarmCatcher); alarm(seconds); rcount = read(fd, buf, size); alarm(0); posignal(SIGALRM, oldHandler); /* * No error checking is reported here. If we got a a signal, we could get * either -1/errno=EINTR, or a short read, depending upon implementation. */ if (rcount < 0) { rcount = 0; } return rcount; } /* * Encipher all the data from sfd to dfd. Send the entire shmeel in timeout * seconds, abort if longer. This routine is used for sending a nologin * message contained in the file /etc/nologin. */ int cipherCopy(dfd, sfd, timeout, key) int dfd, sfd; unsigned timeout; keyType key; { int rcount, wcount = 0; char buf[128], cbuf[128]; register char *bufp = buf; pfv oldHandler; cipherKey cs = mkCipherKey(key, 0); /* encrypt */ if (cs == (cipherKey) 0) return -1; gotalarm = 0; oldHandler = posignal(SIGALRM, alarmCatcher); alarm(timeout); do { while ((rcount = read(sfd, bufp, 1)) > 0) { if (*bufp == '\n') { *bufp++ = '\r'; *bufp = '\n'; } bufp++; if (bufp >= buf + 127 || gotalarm != 0) break; } if (gotalarm != 0) break; rcount = bufp - buf; bufp = buf; cipherData(cbuf, buf, rcount, cs); wcount = write(dfd, cbuf, rcount); if (wcount <= 0) break; } while (gotalarm == 0); alarm(0); posignal(SIGALRM, oldHandler); destroyCipherKey(&cs); if (rcount < 0 || wcount < 0) return -1; return 0; } sfd, bufp, 1)) > 0) { if (*bufp == '\n') { *bufp++ = '\r'; *bufp = '\n'; } bufp++; if (bufp >= buf + 127 || gotalarm != 0) break; } if (gotalarm != 0) break; rcount = bufp - buf; bufp = buf; cipherData(cbuf, buf, rcount, cs);deslogin-1.3/group.c000044400001450000013000000054270572542175000155330ustar00barrettsystem00000000000000/* * @(#) group.c RCS: $Revision: 1.3 $ $Date: 95/03/02 12:54:11 $ * * Get the supplementary group id list from the system /etc/group database. * * There is no POSIX compliant way to do this. BSD provides "initgroups". * * This routine is designed to avoid having to depend upon NGROUPS_MAX being * a compile-time value. The caller must supply storage for the array. Also, * error checking and reporting can be done at a finer grain with this design. * * Depends upon the routine getgrent(3) being available, which it isn't on * posix, but almost always is provided by the unix vendor. */ #if !defined(_POSIX_SOURCE) #define _POSIX_SOURCE #endif #include #include /* NGROUPS_MAX */ #include /* grp.h */ #include /* strcmp */ #include /* getgrent */ #include /* gid_t */ #include "group.h" #include "deslogin.h" /* debug */ #include "log.h" /* log */ /* * Return the list of supplemenatary group id's from the group database * for the given user. Used to get argument for setgroups(2). * * Input: * gidsetsetsize - number of elements in the array grouplist * may be zero to query the number of groups only. * grouplist - the array to fill in with group id's for the user * name - the name of the user to get the group list for. * * Returns: the number of group ids the user actually may have. * < 0 if the group database couldn't be opened or was empty * may be greater than gidsetsize */ int getLoginGroups(gidsetsize, grouplist, name) int gidsetsize; gid_t grouplist[]; char *name; { struct group *grent; register gid_t gid; register char **mem; register int ngroups = -1; /* * Opens the file /etc/group, and gets the first entry, may call network * services for yellow pages lookup. */ grent = getgrent(); if (grent) { ngroups = 0; do { mem = grent->gr_mem; gid = grent->gr_gid; while (*mem) { if (strcmp(name, *mem) == 0) { if (debug > 1) { log("%s: user %s in group %d(%s)\n", progName, name, gid, grent->gr_name); } if ((ngroups < gidsetsize) && (grouplist)) { grouplist[ngroups] = gid; } ngroups++; break; } mem++; } grent = getgrent(); } while (grent); endgrent(); /* close the database file */ } return ngroups; } /* * AnnexB.4.2.3:2669-2670: * The related function setgroups() is a privileged operation and * is not covered by POSIX.1. * * It's usually supplied by the vendor if you #define the appropriate # symbol (__HPUX_SOURCE __OSF_SOURCE etc). */ int setGroups(ngroups, gidset) int ngroups; gid_t *gidset; { int res; res = setgroups(ngroups, gidset); return res; } m++; } grent = getgrent(); } while (grent); endgrent(); /* close the database file */ } return ngroups; } /* * AnnexB.4.2.3:2669-2670: * The related function setgroups() is a privileged operation and * isdeslogin-1.3/tty.c000044400001450000013000000220350572541742600152160ustar00barrettsystem00000000000000/* * @(#) tty.c RCS: $Revision: 1.10 $ $Date: 95/03/02 12:21:21 $ * * Functions to handle terminal console I/O: * * askTty - emit a prompt and read in a passphrase with echo disabled * mkCtrlTty - make the specified device the controlling terminal * setTtyEcho - enable/disable echoing of typed characters * setTtyAscii - Put terminal in ASCII input mode (echo, backspace etc) * setTtyBin - Put terminal into transparent mode (no character interperation) * isTty - query to see if device is a terminal * openCtty - open the controlling terminal * restoreTty - restore the original state of the terminal */ #if !defined(_POSIX_SOURCE) #define _POSIX_SOURCE #endif /* * is necessary for machines which require it for explicitly making * a tty the controlling terminal. This isn't very many. Unfortunately, * won't export TIOCSCTTY if _POSIX_SOURCE is defined on some * machines. To make this situation even worse, #include files are notoriously * sensitve to order; be very careful before changing it. */ #if defined(__ALPHA) || defined(__MIPS) || defined(__bsdi__) #if defined(__MIPS) #undef _POSIX_SOURCE #endif #include /* TIOCNOTTY TIOCSCTTY */ #if defined(__MIPS) #define _POSIX_SOURCE #endif #endif #include /* open ctermid */ #include /* exit */ #include #include #include /* for fcntl.h */ /* * BSDI's BSD/386 has no way to #define ONLCR in if__POSIX_SOURCE * is defined. Also, its value is not 0x04 as it is on all other machines that * have this problem. POSIX really blew it by not having a standard #define to * enable non-posix symbol visability. I can't count on tty drivers enabling * ONLCR when OPOST in enabled either. I also can't just do this for all * machines because HP-UX will make termios.h empty if I undef _POSIX SOURCE. */ #if defined(__bsdi__) #undef _POSIX_SOURCE #endif #include /* tcsetattr ONLCR */ #if defined(__bsdi__) #define _POSIX_SOURCE #endif #include #include /* memcpy */ #include /* ENOTTY */ #include "deslogin.h" #include "log.h" #include "tty.h" #include "posignal.h" extern int debug; /* * Return 1 if the specified fd is associated with a tty device * 0 if not, * -1 if failure */ int isTty(fd) int fd; { struct termios modes; register int res = (tcgetattr(fd, &modes) == 0); if (res == 0) { if (errno != ENOTTY) { --res; } } return res; } int openCtty() { char cttyName[L_ctermid]; int ctty; cttyName[0] = '\0'; /* shouldn't be necessary, but I'm paranoid */ /* * Linux fails to declare "exter char *ctermid()". Add it here if you * get a warning. Linux's needs to be fixed. */ ctty = open(ctermid(cttyName), O_RDWR); /* in Posix */ if (debug) { log("%s: (openCtty) open(ctermid = \"%s\") returned fd %d\n", progName, cttyName, ctty); } if (ctty < 0) { log("%s: open(\"%s\", O_RDWR) failed -- %s\n", progName, cttyName, ERRMSG); } return ctty; } int restoreTty(ttyfd, oldmodes) int ttyfd; struct termios *oldmodes; { int res; res = tcsetattr(ttyfd, TCSANOW, oldmodes); if (res < 0) { log("%s: tcsetattr to fd %d failed -- %s\n", progName, ttyfd, ERRMSG); exit(1); } return 0; } /* * Set the specified tty device to binary (with error report) * Put the original modes in oldmodes. */ int setTtyBin(ttyfd, oldmodes) int ttyfd; struct termios *oldmodes; { struct termios modes; int res; if (oldmodes != (struct termios *) 0) { res = tcgetattr(ttyfd, &modes); if (res < 0) { log("%s: tcgetattr on fd %d failed--%s\n", progName, ttyfd, ERRMSG); exit(1); } memcpy(oldmodes, &modes, sizeof (struct termios)); } modes.c_cflag = CS8 | CREAD; modes.c_iflag = BRKINT; modes.c_oflag &= ~OPOST; /* Don't damage other bits */ modes.c_lflag = 0; modes.c_cc[VMIN] = 1; modes.c_cc[VTIME] = 0; res = cfsetospeed(&modes, B9600); if (res < 0) { log("%s: unsupported speed -- B9600\n", progName); exit(1); } res = tcsetattr(ttyfd, TCSANOW, &modes); if (res < 0) { log("%s: tcsetattr to fd %d failed -- %s\n", progName, ttyfd, ERRMSG); exit(1); } return 0; } /* * Set specified tty to interactive mode */ int setTtyAscii(ctty) int ctty; { int res; struct termios modes; res = tcgetattr(ctty, &modes); if (res < 0) { log("%s: tcgetattr failed --%s\n", progName, ERRMSG); exit(1); } modes.c_cflag = CS8 | CREAD | HUPCL; modes.c_iflag = ICRNL | BRKINT | IXON; modes.c_lflag = ICANON | ECHO | ECHOE | ISIG; modes.c_oflag |= OPOST; modes.c_oflag |= ONLCR; /* ONLCR is not POSIX, but we must set it! */ modes.c_cc[VERASE] = '\b'; modes.c_cc[VINTR] = '\003'; res = cfsetospeed(&modes, B9600); if (res < 0) { log("%s: unsupported speed -- B9600\n", progName); exit(1); } res = tcsetattr(ctty, TCSANOW, &modes); if (debug > 1) { log("%s: tcsetattr returned %d\n", progName, res); } if (res < 0) { log("%s: tcsetattr failed -- %s\n", progName, ERRMSG); exit(1); } return 0; } /* * Set tty echo on(1) or off(0); returns previous setting or -1 */ int setTtyEcho(fd, echo) int fd; int echo; { register int res, oldecho; struct termios modes; res = tcgetattr(fd, &modes); if (res < 0) return -1; oldecho = ((modes.c_lflag & ECHO) != 0); if (echo) { modes.c_lflag |= ECHO; } else { modes.c_lflag &= ~ECHO; } res = tcsetattr(fd, TCSANOW, &modes); if (res < 0) return -2; return oldecho; } /* * Make the specified fd the controlling terminal. * * Some machines require an explicit call. Only the session leader can * do this successfully. Returns: >=0 success, < 0 failure w/errno set. * * If flag is non-zero, make fd a controlling terminal, otherwise make it * not the controlling terminal. */ int mkCtrlTty(fd, flag) int fd, flag; { int res = 0; pid_t pid; #if defined(__ALPHA) || defined(__bsdi__) /* OSF1(DECalpha)tty(7): * In earlier versions of UNIX systems, a controlling terminal was * implicitly assigned to a process if, at the time an open was done on * the terminal, the terminal was not the controlling terminal for any * process, and if the pro-cess doing the open did not have a controlling * terminal. In this version of UNIX, in accordance with POSIX 1003.1, * a process must be a session leader to allocate a controlling terminal. * In addition, the allocation is now done explicitly with a call to * ioctl(). (This implies that the O_NOCTTY flag to the open() * function is ignored.) */ if (flag) { res = ioctl(fd, TIOCSCTTY,0); } else { res = ioctl(fd, TIOCNOTTY,0); } #endif #if defined(__MIPS) /* { */ /* ULTRIX(MIPS)tty(4): * If a process that has no control terminal opens a terminal file, then * that terminal file becomes the control terminal for that process. The * control terminal is thereafter inherited by a child process during a * fork(2), even if the control terminal is closed. */ if (flag) { res = 0; /* Hack for DEC MIPS Ultrix 4.1.2 and 4.1.3 */ } else { res = ioctl(fd, TIOCNOTTY,0); } #endif /* } */ #if defined(__SOLARIS__) /* { */ pid = getpgrp(); if (pid < 0) { log("%s: (mkCtrlTty) getpgrp failed -- %s\n", progName, ERRMSG); } else { res = ioctl(fd, TIOCSPGRP, &pid); if (res < 0) { log("%s: (mkCtrlTty) ioctl(%d, TIOCSPGRP, %d) failed -- %s\n", progName, fd, pid, ERRMSG); } } #endif /* } */ if (debug > 1) { log("%s: (mkCtrlTty)(%d)=%d\n", progName, fd, res); } return res; } int oldEcho = 1; int ttyfd = -1; void restoreEcho(sig) int sig; { if (ttyfd >= 0) { setTtyEcho(ttyfd, oldEcho); close(ttyfd); } exit(0); } /* * Read in a passphrase terminated by '\n' of upto size characters from the * controlling terminal with echo disabled. The phrase strips the '\n', * and appends a '\0'. Intercepts interrupt signal and restores echo. */ int askTty(prompt, str, size, echo) char *prompt; char *str; unsigned size; int echo; { unsigned len = strlen(prompt); register int count; register char *chp = str; register int res = -1; char ch; pfv oldsigint; ttyfd = openCtty(); if (ttyfd == -1) return -1; oldsigint = posignal(SIGINT, restoreEcho); oldEcho = setTtyEcho(ttyfd, echo); count = write(ttyfd, prompt, len); if (count != len) return -1; if (size != 0) do { count = read(ttyfd, &ch, 1); if (count == 0) break; if (count != 1) break; if (ch == '\n') break; *chp++ = ch; } while (--size != 0); if (count >= 0) { res = chp - str; } *chp = '\0'; if (!echo) { count = write(ttyfd, "\n", 1); /* goto next line */ } oldEcho = setTtyEcho(ttyfd, oldEcho); posignal(SIGINT, oldsigint); close(ttyfd); ttyfd = -1; return res; } yfd, prompt, len); if (count != len) return -1; if (size != 0) do { count = read(ttyfd, &ch, 1); if (count == 0) break; if (count != 1) break; if (ch == '\n') break; *chp++ = ch; } while (--size != 0); if (count >= 0) { res = chp - str; } *chp = '\0'; if (!echo) { count = write(ttyfd, "\n", 1); /* goto next line */ } oldEcho = setTtyEcho(ttyfd, oldEcho); posignal(SIGINT, oldsigint); close(ttyfd); deslogin-1.3/posignal.c000044400001450000013000000017130572542146500162100ustar00barrettsystem00000000000000/* * @(#) posignal.c RCS: $Revision: 1.4 $ $Date: 95/03/02 12:54:07 $ */ #if !defined(_POSIX_SOURCE) #define _POSIX_SOURCE #endif #include #include "posignal.h" /* * Signal with posix signal semantics * * Beware! If sysconf(_SC_JOB_CONTROL) != 0, sa_flags must be SA_NOCLDSTOP if * you don't want SIGSTOP to the child to cause SIGCHLD to the caller of this * routine. Note that SIGCHLD may not exist if sysconf() returned zero. * Note also that POSIX SIGCHLD is NOT the same as System V.3 SIGCLD. */ #if defined(__STDC__) || defined(__cplusplus) pfv posignal(int sig, pfv handler) #else pfv posignal(sig, handler) int sig; pfv handler; #endif { struct sigaction sact, oact; int res; sact.sa_handler = handler; /* some compilers break here; see psignal.h */ sact.sa_flags = SA_NOCLDSTOP; sigemptyset(&sact.sa_mask); res = sigaction(sig, &sact, &oact); if (res < 0) { return SIG_ERR; } return oact.sa_handler; } also that POSIX SIGCHLD is NOT the same as System V.3deslogin-1.3/utmp.c000044400001450000013000000304110572726346500153640ustar00barrettsystem00000000000000/* * @(#) utmp.c RCS: $Revision: 1.8 $ $Date: 95/03/08 01:13:19 $ * * This file contains machine specific code for making sure getlogin() works. * See the function setlogin below. * * Make sure login database is updated getut(3c), but this is not * available in POSIX, or SYSV XPG3; it's only a SYSV XPG2 feature. * There thus is no machine independent way to make getlogin work. * * There are two distinct flavors of utmp.h files: * * System V style: SGI's IRIX, Solaris, OSF1, HP-UX, UNICOS # #define ut_name ut_user * struct utmp { * char[] ut_user, ut_id, ut_line; * short ut_pid, ut_type; * struct { short e_termination; short e_exit } ut_exit; except linux * time_t ut_time; * char ut_host[]; // HP-UX, OSF1, UNICOS linux only !Solaris * } * * UTMPX style: Solaris (*almost* the same as system V style!) * struct utmpx { <- different name * char[] ut_user, ut_id, ut_line; * pid_t ut_pid; * short ut_type; * struct exit_status ut_exit; <- same * struct timeval ut_tv; <- different! (BSD style timeofday) * long ut_session; * short ut_syslen; * char ut_host[]; * } * * BSD style: Ultrix, SunOS4.2, UNICOS * struct utmp { * char ut_line[8], ut_name[8], ut_host[16]; * long ut_time; * } * * The least-common denominator of utmp entries: * char ut_line[] device name without path component (e.g. "ttyp4") * 8 chars on BSD, 12 on hp-ux, longer on osf1 * time_t ut_time time entry was made (long on BSD) * char ut_name[8] login name of the user * * The following field is not present on SGI's IRIX and Solaris. * char ut_host[16] host name if remote * * Unfortunately, BSD and System V use different names for the field containing * the user login name (ut_name, ut_user respectively). Fortunately, all * SYSV machines I can find have a #define for ut_name. * * For BSD, empty slots are indicated by ut_name is a null string. * Remote users are indicated by a non-null ut_host field. * * For System V, empty slots are indicated by ut_type field as * DEAD_PROCESS. All other fields must be valid as usual. * * Solaris has two utmp files with different struct formats: * /var/adm/utmp based on using struct utmp. UTMP_FILE * /var/adm/utmpx based on using struct utmpx. UTMPX_FILE * * Changes UTMPX_FILE will not be noticed by the "last" and "who" commands * unless UTMP_FILE is also updated. UTMPX_FILE has an rhost field. */ #define _POSIX_SOURCE /* this isn't quite posix source */ /* * This is a mess. HP-UX ANSI C won't define pid_t in unless * _POSIX_SOURCE is defined. Other machines may refuse to define it. Pick * what's appropriate. uses pid_t. */ #if defined(__SOLARIS__) /* { */ #undef _POSIX_SOURCE /* allows struct timeval to be defined */ #undef _POSIX_C_SOURCE #include /* uid_t size_t */ #include /* time (also needed for "utmp.h") */ #define _POSIX_SOURCE #define _POSIX_C_SOURCE #else /* } { */ #include /* uid_t size_t */ #include /* time (also needed for "utmp.h") */ #endif /* } */ #include /* open read write lseek getuid */ #include #include /* O_RDWR */ #include /* strchr memset */ #include /* struct passwd, getpwuid */ #define OFFSET(s, m) ((unsigned) &(((s *)0)->m)) #include "utmp.h" /* UTMP_FILE WTMP_FILE or */ #include "log.h" #include "deslogin.h" /* progName ERRMSG */ /* * Update the system's "currently logged in users" file (used by "who") * * Input: * utmp_file - the name of the file to update * ut - address of the record insert into file * utbuf - storage for a temporary buffer * utsz - the size of the ut and utbuf record's storage * lineoff - the offset into the record for the ut_line field * linesz - the size of the ut_line field * * Must minimize the time the file is open to prevent write conflict with * other processes trying to update utmp. */ int update_utmp(utmp_file, ut, utbuf, utsz, lineoff, linesz) char *utmp_file; void *ut, *utbuf; unsigned utsz, lineoff, linesz; { int fd, count, res = -1; long offset = 0, lres; fd = open(utmp_file, O_RDWR); if (fd < 0) { log("%s: (update_utmp) open(\"%s\", O_RDWR) failed -- %s\n", progName, utmp_file, ERRMSG); return -1; } /* * Find offset of entry with the same line value if present */ while ((count = read(fd, utbuf, utsz)) == utsz) { if (strncmp((char *)ut+lineoff, (char *)utbuf+lineoff, linesz) == 0) { break; } offset += count; } if (count < 0) { log("%s: (update_utmp) read failed from \"%s\" -- %s\n", progName, utmp_file, ERRMSG); goto utmp_failed; } lres = lseek(fd, (off_t) offset, SEEK_SET); if (lres < 0) { log("%s: (update_utmp) lseek to offset %ld failed in \"%s\" -- %s\n", progName, offset, utmp_file, ERRMSG); goto utmp_failed; } count = write(fd, (char *) ut, utsz); if (count < 0) { log("%s: (update_utmp) write failed to \"%s\" -- %s\n", progName, utmp_file, ERRMSG); goto utmp_failed; } if (count != utsz) { log("%s: (update_utmp) short write to \"%s\"\n", progName, utmp_file); goto utmp_failed; } res = 0; /* success */ utmp_failed: close(fd); return res; } /* * Update the system login history file (used by "last" and "lastb") * * Must minimize the time the file is open to prevent write conflict with * other processes trying to update utmp. */ int update_wtmp(wtmp_file, ut, utsz) char *wtmp_file; void *ut; unsigned utsz; { int fd, count, res = -1; fd = open(wtmp_file, O_WRONLY | O_APPEND); if (fd < 0) { log("%s: (update_wtmp) open(\"%s\", O_WRONLY|O_APPEND) failed -- %s\n", progName, wtmp_file, ERRMSG); return -1; } count = write(fd, ut, utsz); if (count < 0) { log("%s: (update_wtmp) write failed to \"%s\" -- %s\n", progName, wtmp_file, ERRMSG); goto wtmp_failed; } if (count != utsz) { log("%s: (update_wtmp) short write to \"%s\"\n", progName, wtmp_file); goto wtmp_failed; } res = 0; /* success */ wtmp_failed: close(fd); return res; } /* * The inverse of the POSIX getlogin call. Setup the login for the given * user name. * * Input: * tty = the device file assigned as the controlling terminal * name = the login name (only first 8 characters signifacant) * rhost = the hostname of the remote host (only 1st 16 chars used) * statloc = the address of the process exit status * (if zero, then this is a new process stating up) * * The calling process should ensure that it owns the tty before it calls * this routine, or it could overwrite a legitimate processes tty. * * Returns: 0 success, -1 failure. */ int setlogin(tty, username, rhost, statloc) char *tty, *username, *rhost; int *statloc; { char *line, *id; long offset; int res; struct utmp ut, utbuf; #if defined(UTMPX_FILE) /* { */ struct utmpx utx, utxbuf; #endif /* } */ if ((tty == 0) || (username == 0) || (rhost == 0)) return -1; /* * There are two possibly conflicting ways to get the line: * 1) take the last component of the path (SYSV) (e.g. fails for /dev/pts/6) * 2) Strip of the first component of the path. (irix) (/dev/pts/6 = pts/6) * 3) Don't strip any components at all (Solaris) * * Which one is the most "popular"? Probably should be a compile-time test. * I'm using the last component of the path. */ line = strchr(tty, '/'); if (line == tty) { line = strchr(tty + 1, '/'); if (line == (char *) 0) line = tty; } if (line == (char *) 0) line = tty; else line++; /* * The id field (for init) is the last two characters of the line on SYSV * For SOLARIS, id is prefixed by two character service abbreviation. * (e.g. Telnet is 'tn', rlogin is 'rl') * I'm using the last two characters of the line. */ offset = strlen(line) - 2; if (offset < 0) offset = 0; id = line + offset; #if defined(UTMPX_FILE) /* { */ memset(&utx, '\0', sizeof utx); #endif /* } */ memset(&ut, '\0', sizeof ut); time((time_t *) &ut.ut_time); strncpy(ut.ut_line, line, sizeof ut.ut_line); strncpy(ut.ut_name, username, sizeof ut.ut_name); #if defined(USER_PROCESS) /* { SYSV */ strncpy(ut.ut_id, id, sizeof ut.ut_id); ut.ut_pid = getpid(); ut.ut_type = USER_PROCESS; /* assume login until proven othewise */ if (statloc != 0) { /* process exit */ ut.ut_type = DEAD_PROCESS; #if !defined(_LINUX_SOURCE) /* { */ ut.ut_exit.e_termination = *statloc & 0xff; ut.ut_exit.e_exit = (*statloc >> 8) & 0xff; #endif /* } */ } #else /* } { BSD */ if (statloc != 0) { ut.ut_name[0] = '\0'; } #endif /* } BSD */ #if !defined(__sgi) && !defined(__DYNIX__) && !defined(__SOLARIS__) /* { */ strncpy(ut.ut_host, rhost, sizeof ut.ut_host); #endif /* } */ /* * This used to be broken for __DYNIX__ and __SOLARIS__. * Version 1.3 fixed this. If not, mail barrett@asgard.cs.colorado.edu */ res = update_utmp(UTMP_FILE, &ut, &utbuf, sizeof ut, OFFSET(struct utmp, ut_line), sizeof ut.ut_line); if (res >= 0) { res = update_wtmp(WTMP_FILE, &ut, sizeof ut); } #if defined(UTMPX_FILE) /* { __SOLARIS__ */ getutmpx(&ut, &utx); /* no return result */ gettimeofday(&utx.ut_tv); /* shouldn't be necessary; do it anyway */ strncpy(utx.ut_host, rhost, sizeof utx.ut_host); if (res >= 0) { res = update_utmp(UTMPX_FILE, &utx, &utxbuf, sizeof utx, OFFSET(struct utmpx, ut_line), sizeof utx.ut_line); } if (res >= 0) { res = update_wtmp(WTMPX_FILE, &utx, sizeof utx); } #endif /* } */ return res; } /* * Because of severe braindamage, the POSIX getlogin() call has a * high-probability of failing to work on many machines. The things to * consider are: * * This process must have a controlling terminal to determine the tty line * to lookup in utmp. * * There must be a (unique) entry for that line in utmp. * * There is no guarantee that the contents of utmp is correct. (It's world * writable on most SUN BSD machines for example! Thus, the login name * returned there may not be correct at all. * * cuserid() is obsolete. The problem is that it could return the login * name corresponding to the effective user id instead of the real user id. * * There may be multiple user names corresponding to each user id. * * The bottom line is that there is *no way* to accurately determine which * of the (possibly many) login names were used to get this particular real * user id. * * I've decided not to trust utmp at all, and just to get the first valid * user id using the POSIX.1 conformant calls to , getpwuid. * * Note that the only "portable" fields of a struct passwd are: * * char *pw_name * char *pw_passwd * uid_t pw_uid * gid_t pw_gid * * The only way this routine should fail (returning (char *) 0) is if * /etc/passwd is not readable. Note that yellow-pages lookups could occur * as a result of using this function. * * AnnexB.4.2.4:2682-2694 * The getlogin() function returns a pointer to the user's login name. The * same user ID may be shared by several login names. If it is desired to get * the user database entry that is used during login, the result of getlogin() * should be used to provide the argument to the getpwnam() function. (This * might be used to determine the user's login shell, particularly where a * single user has multiple login shells with distinct login names, but the * same user ID.) * The information provided by the cuserid() function, which was originally * defined in IEEE Std 1003.1-1990 and subsequently removed, can be obtained * by the following: getpwuid(geteuid()), while the information provided by * historical implementations of cuserid() can be obtained by: * getpwuid(getuid()). */ char *getLoginName() { register uid_t uid = getuid(); register struct passwd *pwent; pwent = getpwuid(uid); if (pwent == (struct passwd *) 0) { return (char *) 0; } else { return pwent->pw_name; } } d() function, which was originally * defined in IEEE Std 1003.1-1990 and subsequently removed, can be obtained * by the following: getpwuid(geteuid()), while the information provided by * historical implementations of cuserid() can be obtaineddeslogin-1.3/auth.c000044400001450000013000000200660572542147400153370ustar00barrettsystem00000000000000/* * @(#) auth.c RCS: $Revision: 1.4 $ $Date: 95/03/02 12:53:56 $ * * This file contains all the routines needed to interface to routines to * perform digital signatures, and stream data encryption. Currently it * uses the des. If another method is used, this module should be the only * one changed. */ #define _POSIX_SOURCE #include /* pid_t */ #include /* write getpid */ #include #include /* memset memcmp */ #include /* isspace */ #include /* exit free (after ctype.h for BSDI BSD/386) */ #include #include "auth.h" #include "txfr.h" #include "log.h" #include "deslogin.h" extern int verbose; typedef struct { char iv[DES_BLOCKSIZE]; unsigned ivlen; keyType key; int mode; } cipherState; cipherKey mkCipherKey(key, mode) keyType key; int mode; { cipherState *cs =(cipherState *)malloc(sizeof (cipherState)); if (cs != (cipherState *) 0) { memset(cs->iv, '\0', DES_BLOCKSIZE); cs->ivlen = DES_BLOCKSIZE; cs->key = key; cs->mode = mode; } return (cipherKey) cs; } void destroyCipherKey(c) cipherKey *c; { register cipherState *cs = * (cipherState **) c; if (cs != (cipherState *) 0) { memset(cs->iv, '\0', DES_BLOCKSIZE); cs->ivlen = 0; cs->key = (keyType) 0; cs->mode = 0; free(cs); *c = (cipherKey) 0; } } void cipherData(dst, src, size, c) char *dst, *src; unsigned size; cipherKey c; { register cipherState *cs = (cipherState *) c; if (cs->key != (keyType) 0) { cs->ivlen = desCFB(dst, src, size, cs->iv, cs->ivlen, cs->key, cs->mode); } else { memcpy(dst, src, size); } } /* * Convert a string of bytes to their hex representation */ char *hexData(dst, src, size) register char *dst, *src; register unsigned size; { register char *chp = dst; if (size != 0) do { sprintf(chp, "%.2x", * (unsigned char *) src++); chp += 2; } while (--size != 0); return dst; } /* * Create a key from a keyString * * Mode: 0 = encrypt, 1 = decrypt */ keyType mkKey(keyString) char *keyString; { char keybits[DES_BLOCKSIZE]; keyType key = (keyType) 0; desKey(keybits, keyString, ' '); /* hash string into 64-bits */ desMakeKey(&key, keybits, DES_BLOCKSIZE, 0); /* always encrypt for CFB */ memset(keybits, '\0', DES_BLOCKSIZE); return key; } /* * Perform one DES encryption(decryption if mode nonzero) (ECB mode) * * Dst and src must be exactly DES_BLOCKSIZE bytes long. */ void cipherKeyString(dst, src, keyString, mode) char *dst, *src, *keyString; int mode; /* 0 = encipher, 1 = decipher */ { char keybits[DES_BLOCKSIZE]; keyType key = (keyType) 0; desKey(keybits, keyString, ' '); /* hash string into 64-bits */ desMakeKey(&key, keybits, DES_BLOCKSIZE, mode); memset(keybits, '\0', DES_BLOCKSIZE); des(dst, src, key); desDestroyKey(&key); } /* * Generate a unique session key from the challenge. The idea here is to allow * the program on both the client and server side to destroy the user's * private key from memory ASAP. If a user on the local machine tries to * scan the process memory, they can only compromise the session key and not * the user's long-term login key. */ keyType sessionKey(challenge, keyString, mode) char *challenge, *keyString; int mode; { char keybits[DES_BLOCKSIZE]; keyType res = (keyType) 0; cipherKeyString(keybits, challenge, keyString, 0); /* encrypt */ desMakeKey(&res, keybits, DES_BLOCKSIZE, mode); memset(keybits, '\0', DES_BLOCKSIZE); return res; } /* * Issue and validate a crypto challenge * * Returns: session key if success, 0 if failure */ keyType challenge(fd, keyString, timeout) int fd; char *keyString; unsigned timeout; { char plainText[DES_BLOCKSIZE], cipherText[DES_BLOCKSIZE]; char buf[DES_BLOCKSIZE], buf2[DES_BLOCKSIZE*2+1]; int wcount, rcount, res; keyType result = (keyType) 0; /* * The challenge message must be unpredictable and ideally, never reused * to prevent playback, or anticipating the next challenge response * * To make it unpredictable, take the current time + current pid , and * encipher it once with the user's key. This is then used as the * plaintext of the challenge. */ memset(cipherText, '\0', DES_BLOCKSIZE); time((time_t *) &cipherText[0]); * (unsigned *) &cipherText[4] = (unsigned) getpid(); cipherKeyString(plainText, cipherText, keyString, 0); cipherKeyString(cipherText, plainText, keyString, 0); /* encrypt */ if (debug) { log("%s: challenge(%s)\n", progName, hexData(buf2, cipherText, DES_BLOCKSIZE)); } wcount = write(fd, cipherText, DES_BLOCKSIZE); if (wcount != DES_BLOCKSIZE) { log("%s: challenge--write failed; %s\n", progName, ERRMSG); exit(1); } cipherKeyString(buf, cipherText, keyString, 1); /* decrypt */ rcount = getBlock(fd, buf, DES_BLOCKSIZE, timeout); /* decrypt */ if (debug) { if (rcount > 0) { log("%s: response(%s)\n", progName, hexData(buf2, buf, DES_BLOCKSIZE)); } } /* * The remote user deciphers the challenge and it'd better be the same * as the one we originally enciphered to be a valid signature */ if (rcount == DES_BLOCKSIZE) { res = memcmp(buf, plainText, DES_BLOCKSIZE); if (res == 0) { result = sessionKey(cipherText, keyString, 0); } } return result; } /* * Wait for and respond to a crypto challenge return the session key. */ keyType signature(fd, keyString, timeout) int fd; char *keyString; unsigned timeout; { keyType res = (keyType) 0; char plainText[DES_BLOCKSIZE], cipherText[DES_BLOCKSIZE]; register int wcount = -1, rcount; rcount = getBlock(fd, cipherText, DES_BLOCKSIZE, timeout); if (rcount == DES_BLOCKSIZE) { cipherKeyString(plainText, cipherText, keyString, 1); /* decrypt */ wcount = write(fd, plainText, rcount); res = sessionKey(cipherText, keyString, 0); } return res; } /* * Find the corresponding passphrase for the given user name. * * The user file is a sequence of lines with username passphrase pairs * Lines beginning with '#' are comments, empty lines are permitted. * * Returns: -2 if key incorrect, -1 if open failed, 0 no such user, 1 success */ int getUserPhrase(fname, phrase, size, uname, key) char *fname; register char *phrase; register unsigned size; char *uname; keyType key; { register int i; char cipherChar, ch; register int res = -2, state = 0; register char *chp = 0; FILE *f = fopen(fname, "r"); cipherKey ck = (cipherKey) 0; ck = mkCipherKey(key, 1); /* decrypt */ if (f == NULL) return -1; do { i = getc(f); if (i == EOF) { res = 0; break; } cipherChar = (char) i; cipherData(&ch, &cipherChar, 1, ck); if (ch & 0x80) break; /* non-printable character: stop! */ switch (state) { case 0: if (ch == '#') { state = 1; break; } chp = uname; state = 2; /* fall through */ case 2: /* user field leading whitespace */ if (ch == '\n') state = 0; if (ch == '#') { state = 1; break; } if (isspace(ch)) break; /* newline is also whitespace */ state = 3; /* fall through */ case 3: /* user field */ if (!isspace(ch)) { if (*chp++ != ch) state = 1; } else { if (*chp == '\0') { /* match? */ if (ch == '\n') state = 6; else state = 4; if (verbose) log("founduser\n"); } else { state = 0; } } break; case 1: /* skip remainder of line */ if (ch == '\n') state = 0; break; case 4: /* passphrase leading whitespace */ if (ch == '\n') state = 6; if (isspace(ch)) break; state = 5; /* fall through */ chp = phrase; case 5: /* passphrase */ if (ch == '\n') { if (size != 0) *chp = '\0'; state = 6; res = 1; } else { if (size != 0) { *chp++ = ch; --size; } } break; } } while (state != 6); destroyCipherKey(&ck); fclose(f); return res; } er of line */ if (ch == '\n') state = 0; break; case 4: /* passphrase leading whitespace */ if (ch == '\n') state = 6; if (isspace(ch)) break; state = 5; /* fall through */ chp = phrase; case 5: /* passphrase */ if (ch == '\n') { if (size != 0) *chp = '\0'; state = 6; res = 1; } else { if (size != 0) { *chp++ = ch; --size; } } break; } } while (state != 6); ddeslogin-1.3/gendeskd.c000044400001450000013000000112720557735464600161740ustar00barrettsystem00000000000000/* * Create a C program which is a des key definition for * key represesting the output from desMakeKey with the passphrase supplied * by the user. */ #define _POSIX_SOURCE #include /* close getlogin */ #include /* atexit exit */ #include #include #include "des.h" #include "desdefs.h" extern int optind; extern char *optarg; static char ident[] = " @(#) gendeskd.c version 1.00 14-Jun-94 Copyright 1994 by Dave Barrett(barrett@asgard.cs.Colorado.EDU)\n"; static char RCSid[] = " @(#) gendeskd.c RCS: $Revision: 1.4 $ $Date: 94/06/14 10:05:05 $\n"; char *progName; int debug = 0; int verbose = 0; #if defined(__STDC__) || defined(__cplusplus) extern int getkey(char *, char *, unsigned); #else extern int getkey(); #endif typedef unsigned char block[DES_BLOCKSIZE]; /* * Keys which could accidently reproduce the plaintext with multiple-encryption */ block badKeys[16] = { { 0xe0, 0x00, 0xe0, 0x00, 0xf0, 0x00, 0xf0, 0x00 }, { 0x00, 0xe0, 0x00, 0xe0, 0x00, 0xf0, 0x00, 0xf0 }, { 0xfe, 0x1e, 0xfe, 0x1e, 0xfe, 0x0e, 0xfe, 0x0e }, { 0x1e, 0xfe, 0x1e, 0xfe, 0x0e, 0xfe, 0x0e, 0xfe }, { 0xe0, 0x1e, 0xe0, 0x1e, 0xf0, 0x0e, 0xf0, 0x0e }, { 0x1e, 0xe0, 0x1e, 0xe0, 0x0e, 0xf0, 0x0e, 0xf0 }, { 0x00, 0xfe, 0x00, 0xfe, 0x00, 0xfe, 0x00, 0xfe }, { 0xfe, 0x00, 0xfe, 0x00, 0xfe, 0x00, 0xfe, 0x00 }, { 0x00, 0x1e, 0x00, 0x1e, 0x00, 0x0e, 0x00, 0x0e }, { 0x1e, 0x00, 0x1e, 0x00, 0x0e, 0x00, 0x0e, 0x00 }, { 0xe0, 0xfe, 0xe0, 0xfe, 0xf0, 0xfe, 0xf0, 0xfe }, { 0xfe, 0xe0, 0xfe, 0xe0, 0xfe, 0xf0, 0xfe, 0xf0 }, { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, /* self-dual */ { 0xfe, 0xfe, 0xfe, 0xfe, 0xfe, 0xfe, 0xfe, 0xfe }, /* self-dual */ { 0xe0, 0xe0, 0xe0, 0xe0, 0xf0, 0xf0, 0xf0, 0xf0 }, /* self-dual */ { 0x1e, 0x1e, 0x1e, 0x1e, 0x0e, 0x0e, 0x0e, 0x0e }, /* self-dual */ }; /* * Return nonzero if the key is one of the well-known "weak" keys (FIPS Pub 74) */ int weakKey(keybits) char *keybits; { register block *keyp = &(badKeys[0]); /* common compiler bug here */ register unsigned count = sizeof(badKeys) / sizeof(badKeys[0]); register unsigned i; do { for (i = 0; i < DES_BLOCKSIZE; i++) { if ((((*keyp)[i] ^ keybits[i]) & 0xfe) != 0) goto notfound; } break; notfound: keyp++; } while (--count != 0); return count; } /* * Because we are using CFB, we always encrypt. Since we'd like to be * able to run the chips in either mode, perhaps CBC would be better. * If CBC is used though, the last block must be handled in OFB mode. Sigh. * * Returns: * -1 - out of memory (program exits, and error reported) * 0 - success * 1 - key is a weak key */ int setKey(kp, keybits, keystr, mode) register keyType *kp; char *keybits, *keystr; int mode; { register int res; if (keystr != (char *) 0) { desKey(keybits, keystr, ' '); /* space padded */ memset(keystr, '\0', strlen(keystr)); /* blank out key asap */ } res = weakKey(keybits); desMakeKey(kp, keybits, DES_BLOCKSIZE, mode); /* 0 means encrypt mode */ memset(keybits, '\0', DES_BLOCKSIZE); /* zero out bits asap */ if (*kp == (keyType) 0) { fprintf(stderr, "%s: couldn't allocate memory for encryption key\n", progName); exit(1); } return res; } #define KEYBUFLEN 255 int main(argc, argv) int argc; char *argv[]; { int i, ch, j, size; unsigned char *uchp; int keystrlen = 0; char *chp; char keybuf[KEYBUFLEN], keybits[DES_BLOCKSIZE]; keyType key = 0; progName = *argv; if ((chp = strrchr(progName, '/')) != (char *) 0) progName = chp + 1; while ((ch = getopt(argc, argv, "-d")) != EOF) switch (ch) { case 'd': debug++; break; default: fprintf(stderr, "usage: %s [-d]\n", progName); exit(1); } argc -= optind; argv += optind; keystrlen = getkey("Input Default UserFile PassPhrase: ", keybuf, KEYBUFLEN-1); if (keystrlen == 0) { fprintf(stderr, "%s: must specify a non-null key\n", progName); return 1; } keybuf[keystrlen] = '\0'; i = setKey(&key, keybits, keybuf, 0); if (i) { fprintf(stderr, "%s: weak key selected, use another.\n", progName); return 1; } size = (sizeof (desKeyType)) - (sizeof (unsigned long)); printf("struct { unsigned long align; unsigned char bytes[%u]; }\n", size); printf ("defaultKey = { 0x%lx, {", * (unsigned long *) key); j = 0; uchp = (unsigned char *) &((unsigned long *) key)[1]; for (i = 0; i < size; i++) { if (i % 14 == 0) { printf("\n "); } printf("0x%.2x", *uchp++); if (i != size) { printf(","); } } printf("\n}};\n"); return 0; } gName); return 1; } size = (sizeof (desKeyType)) - (sizeof (unsigned long)); printf("struct { unsigned long align; unsigned char bytes[%u]; }\n", size); printf ("defaultKey = { 0x%lx, {", * (unsigned long *) key); j = 0; uchp = (unsigned char *) &((unsigned long *) key)[1]; for (i = 0; i < sdeslogin-1.3/deslogin.1000044400001450000013000000245730557737010400161250ustar00barrettsystem00000000000000.\" @(#) $RCSfile$ $Revision: 1.3 $ $Date: 94/06/14 11:59:36 $ .TH DESLOGIN 1 14-Jun-94 .ds )H David A. Barrett .ds ]W Rev. 1.1 June 1994 .SH NAME deslogin \- DES authenticated and encrypted Network login .SH SYNOPSIS .B deslogin [ .B \-dv ] [ .B \-g .I gateway ] [ [ user\@]domain[:port] ] .SH DESCRIPTION .PP .I Deslogin\^ is a network login program similar to telnet but more secure. Unlike telnet, it does not transmit passwords across the network. Since passwords (actually pass phrases) may be arbitrarily long, they don't fall prey to password guessing attacks like the eight-character ones of telnet and login do. .PP .I Deslogin also encrypts both directions of the data stream of the login session, so network snooping cannot reveal sensitive information accessed during the session (such as using the su command to become root). Encryption also protects the connection from being hijacked. .PP .I Deslogin attempts to connect to the specified remote system as the specified user at the specified port. If no system or user is given, .I deslogin will prompt you. If no port is specified, the default one from /etc/services (usually 3005) is used. If no user name is given, the local user name from .I (getlogin(3)) is used. .PP .I Deslogin prompts you for a pass phrase. This phrase, known only to you and the remote machine, is used to authenticate your identity to the remote host. You may use an arbitrarily long sequence of characters for the phrase. I find that short sentences make excellent easy-to-use choices. .PP If the authentication is successful, you will be logged into the remote host with your standard shell, user-id, and environment. All information transmitted or received from the remote host is encrypted using the United States Data Encryption Standard in cipher-feedback mode. The data encryption key is unique for each .I deslogin invocation. This prevents playback attacks and drastically reduces the time the login passphrase is subject to attack. If any part of authentication fails, .I deslogin exits without comment. .PP Often (almost always), the remote host will place an inactivity timer on your login session. This helps prevent the remote host from being compromised if you walk away from your machine while a .I deslogin session is active. Typically this timer is kept short (default is 20 minutes) to reduce the window of opportunity for someone walking up to your machine while you are away. Don't leave .I deslogin sessions unattended. If you don't have any input/output going to your session for the inactivity period, the session is shut down immediately without warning. If the timeout is too short, talk to the installer of .I deslogind(3) on the remote host. .SS Options .PP .TP 11 .B \-d enable debug output (can't be used by attacker to compromise keys) .TP .B \-v Verbose mode. Enable verbose output of messages. .TP .BI \-g\ gateway Specifies a host:port to use as a gateway. .I Deslogin sessions can be routed through a gateway process installed on a "firewall" machine. The :port is optional. If not specified the default port from /etc/services (usually 3006) is used. Firewalls often exist at entrances to secure networks. This option causes .I deslogin to prompt you for a gateway passphrase which is used to authenticate yourself to the gateway. This passphrase is probably different than the passphrase for the host you are logging into. Once the gateway is satisfied of your identity, it routes your login session to a remote machine, which will authenticate you and encrypts the session in the usual manner. You have no access to the gateway machine, and no user (even root) on the gateway will be able to examine information flowing through the gateway. .SH WARNINGS .PP Do not leave .I deslogin sessions unattended. Someone can walk right up to your keyboard and do anything you can. .PP You should take great care to preserve the secrecy of your passphrase(s). Don't let people watch the keyboard while you type in the passphrase; it's been done with telephone access cards with binoculars in airports! Don't write down your passphrase; pick a sentence that is easy for you to remember; any characters are allowed, including punction and spaces. .PP Always invoke .I deslogin on the local host. Do not use telnet (rlogin, xterm, etc.) to a remote machine, and then invoke .I deslogin on that machine to get to another. If you do, the keystrokes of your passphrase will appear on the network between the local and remote telnet hosts. .PP On machines served by X-windows, use the "Secure Keyboard" option from the xterm "main menu" usually invoked by the CTRL-. This feature is supposed to prevent X-windows clients authorized to connect to your server from being able to intercept your keystrokes into that xterm window. The window should change color when this option is in effect. You only need to protect keystrokes while you are entering the passphrase. If you are concerned about your session data being snooped, you still need to ensure that other X clients cannot access your Xserver root and session windows. Xwindows has other security holes such as unix-domain sockets in filesystem directories, frame buffer and keyboard device files. .PP Even then, you must make sure that the terminal pty (/dev/ttyp*) associated with your xterm window is not subject to hijacking or eavesdropping. You can find out the pty by using the .I tty(1) command. Check the permissions and ownership of that device file to ensure that it cannot be read by intruders on your local machine. .PP The same applies to the device special files for your screen frame buffer and keyboard interface. .PP .I Deslogin erases the memory storing your passphrase, and the resulting keys immediately after entry. Only a hashed form of your session key remains buried in the data segment of your .I deslogin process. It is possible for a sufficiently determined attacker with root permission to your local machine to read the memory of your .I deslogin process and compromise your session key. This won't help them determine your passphrase though. .PP In order to prevent idle traffic analysis by casual users, you should avoid specifying any arguments to .I deslogin; just respond to the prompts instead. .PP Beware of "trojan horses". When you invoke .I deslogin, make sure that you aren't invoking another program in a directory in your PATH environment variable which has been placed there by a hostile user. If you PATH includes directories on remote machines, (especially including the current directory: '.'), be sure that the remote machines are trusted by you. Invoking .I deslogin by its full path name on a local filessytem prevents this problem if the attacker hasn't replaced the original. .PP It is still possible that someone on the network between the two .I deslogin hosts can attempt to record or insert data (possibly from a previous session) into your encrypted data stream. If this happens, you will see garbage characters appear on your screen since the inserted data will be from a session using a different session key. I've used this program for several years and have never seen this happen, but it's possible. .PP Summary: .I Deslogin is designed to protect you from unsecure networks traversed between your (secure) local host and a secure remote host. It is best to use .I deslogin on a local machine which is not subject to a determined attack from hostile local users. This is quite commonly a valid assumption; just be aware when you are making it. If you have reason to strongly distrust root capable users on the local machine, do not use .I deslogin to access a highly secure machine. .SH AUTHENTICATION PROTOCOL .PP .I Deslogin uses a "challenge-response" protocol to authenticate users. The remote host encrypts a 64-bit unique unpredictable nonce and sends it as the "challenge". .I Deslogin then asks you for your passphrase which is hashed into a 56-bit DES authentication key used to decrypt the challenge and send back the 64-bit "response". The remote host (which shares knowledge of your passphrase) decrypts the response and compares the result with the nonce used to generate the challenge. If they're equal, authentication succeeds and a unique session key is generated by encrypting the challenge with your DES key. The authentication key is immediately destroyed and the session key is then used to encrypt all other data transferred. .SH ENVIRONMENT .PP See the .I deslogin(1) manual page under the .I ENVIRONMENT section for useful environment variables such as .B TERM and .B RHOSTNAME. .SH MISSING FEATURES .PP A more secure system would allow you to authenticate the identity of the remote host. In practice this is not likely to be a serious problem since someone attempting to "spoof" a remote host can only trick you into "signing" the authentication challenge packet by encrypting it with the DES key corresponding to your passphrase. The conjecture is that DES has properties that make this computationally infeasible. Some disagree. .PP Some method for the local netlogin to authenticate itself to you should be devised to prevent trojan horses from masquerading as netlogin and tricking you into revealing your passphrase. .PP There needs to be a way for users to change their passphrases. Currently, the administrator on the remote machine must set the passphrase. This could be construed as a "feature" since it allows the administrator to verify the passphrase difficult to guess. .SH ACKNOWLEDGEMENTS .PP The author has made every attempt to produce a secure and portable authenticated login program. I havn't had time to integrate this with telnet and the myriads of telnet protocol extensions, which would have been the "right" way to implement this program. Comments and improvements will be greatly appreciated and should be directed to the author: .PP David A. Barrett (barrett@asgard.cs.Colorado.EDU) .PP Copyright 1994 by David. A. Barrett. .PP This program is not to be distributed for profit or included in such software without written permission from the author. No permission is required for non-profit use. .SH FILES .ta 1i /dev/tty to output prompt and read passphrase .DT .SH SEE ALSO cipher(1), telnet(1), rlogin(1), deslogind(1), deslogingw(1), tty(1), getlogin(3). .\" index \fIdeslogin\fR \- DES authenticated encrypted login \s-2DESLOGIN\s+1(1)\s+1 .\" .\" toc \s-2DESLOGIN\s+1(1)\s+1:\0\0\fIdeslogin\fR DES authenticated/encrypted login P This program is not to be distributed for profit or included in such software without written permission from the author. No permisdeslogin-1.3/deslogind.1000044400001450000013000000225450557737010500162670ustar00barrettsystem00000000000000.\" @(#) $RCSfile$ $Revision: 1.5 $ $Date: 94/06/14 11:59:48 $ .TH DESLOGIND 1 14-Jun-94 .ds )H David A. Barrett .ds ]W Rev. 1.1 Jun 1994 .SH NAME deslogind \- daemon for deslogin .SH SYNOPSIS .B deslogind .B \[\-dnc\] .B \[\-f .I userFile\] .B \[\-l .I logFile\] .B \[\-w .I name\] .B \[\-p .I port\] .br .in 15 .B \[\-k .I cipherKey\] .B \[\-i .I inactiveSecs\] .B \[\-t .I loginSecs\] .SH DESCRIPTION .PP .I Deslogind\^ is the daemon for the .I deslogin(1) program, a secure DES authenticated and encrypted login service. This deamon may be run from inetd, or in a standalone fashion. When invoked, it posts a listen(2) on the specified port. When a connection request arrives, it authenticates the remote user and starts up a new login session for the user. All subsequent data transmitted between the session and the remote host is encrypted using the United States Data Encryption Standand in cipher-feedback mode using a unique key for each session. Authentication is performed using a challenge-response protocol that does not transmit passwords over the network. Pass phrases are used for authentication rather than the eight-character passwords of .I login(1). User names and passphrases are looked up in a file which has been DES encrypted by the .I cipher(1) program. A gateway service to allow access through a firewall is also available (see .I deslogingw(1)). .SS Options .PP .TP 12 .BI \-f\ userFile Specifies the encrypted file containing user passphrases (Default: /usr/local/etc/netlogind.users). Each line of the file is an 8-character username, a tab, then a passphrase containing any number of 7-bit characters. Lines beginning with a pound "#" character are comments. Use the .I cipher(1) program to create the encrypted userFile from your plaintext. Use the -d option with .I cipher to view the encrypted userFile. Make sure to destroy the plaintext once you've verified the encrypted copy is decipherable. .TP .BI \-k Specify a phrase used as the key for decrypting the userFile. If the .BI \-k option is not used, .I netlogind requests one when it is invoked. Don't use the .I -k option except for debugging and testing: the command line is visable to any user with the .I ps(1) command. .TP .BI \-c Don't prompt for a userFile cipher key. Use the compiled default. Use this option when you must invoke .I deslogind without human intervention (say from inetd). Don't use this option if the executable file for .I deslogind is readable by sufficiently determined hostile users. .TP .BI \-n The userFile is plaintext. Don't prompt for a userFile cipher key. You shouldn't put userFile where it's readable by hostile users. .TP .B \-d enable debug output (can't be used by attacker to compromise keys) Use more -d's to get more output. Debug levels greater than 1 prevent any forking of the process which allows use of a debugger. .TP .BI \-l\ logFile Specifies a file for recording connection, login, and logout statistics. (Default: /usr/adm/netlogind.log) .TP .BI \-i\ inactiveSecs An integer specifying the number of seconds of inactivity before the session is terminated (default: 20 minutes). This is a security feature to reduce the probability that an unattended remote session can be exploited by an intruder at the remote site. .TP .BI \-t\ loginSecs An integer specifying the number of seconds to wait for a response after issuing the challenge (default: 60 seconds). The remote user must be able to type the passphrase correctly within this time period including network delays. .TP .BI \-w\ name Run as a wrapper to login. A single system-wide passphrase must be in userFile under the name argument givin with the -w option. Successful authentication invokes the login program instead of a user shell. .TP .BI \-p\ port An integer specifying the TCP port number used to listen for requests. If none is given, /etc/services is consulted. If the deslogin service isn't present, 3005 is used. .SH WARNINGS .PP The method used to encrypt the userFile could be better. It's only appropriate for machines which don't have "sufficiently determined" hostile local users. A sufficiently determined hostile user is one who can examine the run-time data segment of another user's deslogind process. They could then look for the internal data structure holding the binary form of the hashed userFile cipher key. Armed with the binary key, they could obtain and modify the source code for .I cipher to accept the binary data as input and use it to read and decrypt the userFile. Some protection is given by statically linking and stripping .I deslogind and by ensuring .I deslogind and the userFile are owned by root, and not readable (or writable) by other users. .PP Changing the passphrase requires decrypting the userFile using the .I cipher(1) program, editing the cleartext in a secure local directory from a secure local session, re-enciphering, and overwriting the entire plaintext file. .SH AUTHENTICATION PROTOCOL .PP .I Deslogind uses a "challenge-response" protocol to authenticate users. Upon connection, the remote host sends a line containing the remote user name, then another giving the login name for the local user. .I Deslogind looks up local user name in the userFile and retrieves the corresponding passphrase which is hashed to produce the user's DES authentication key. An "unpredictable" 64-bit nonce is generated by using the user's authentication key with DES in ECB mode to encrypt the (LSB zero-padded) output of time(2) and getpid(2). .I Deslogind then encrypts this nonce with the user DES key and sends it as the challenge to the remote machine. The remote .I deslogin prompts the user for a passphrase which is hashed into a DES key used to decipher the challenge and send back the 64-bit "response". .I Deslogind compares the response with the nonce; if they're equal, authentication succeeds and a unique session key is generated by encrypting the challenge with the user's DES key. The authentication keys are destroyed by both hosts, and the session key is then used to encrypt all other data transferred. .SH NOTE .PP .I Deslogind does not require root permission to be useful. Regular users may create their own userFiles, encrypt them with cipher, and give appropriate options to .I deslogind to allow remote login to their account from remote mechines traversing untrusted networks. This is especially useful when you will be away from work and want to be able to access your machine in a safe manner from another trusted site (your home, say). When used in this manner, you cannot became any user other than the owner of .I deslogind. .PP For example, the user "martha" on the host "uunet" could do the following: .PP .RS $ cipher >$HOME/deslogind.users .br Input Key: .br Verify Key: .br martha My simple passPhrase .br $ deslogind -l ~/deslogind.log -f ~/userFile -p 2010 .br UserFile cipher key: .br .RE .PP She can now login from a remote machine by the command: .PP .RS .br $ deslogin martha@uunet:2010 .br Pass Phrase: .br uunet $ .br .ne 7 .SH ENVIRONMENT .PP The following environment variables are set by .I deslogind: .TP 10 .B LOGNAME The authenticated local user name .TP .B USER Same value as LOGNAME (for BSD users) .TP .B HOME The home directory as taken from /etc/passwd .TP .B SHELL The login shell as taken from /etc/passwd .TP .B PATH Where to look for executables. Set to ":/bin:/usr/bin". .TP .B TZ The timezone of the host where deslogind is running. .TP .B MAIL The location of the user's maildrop (HP-UX only). Set to "/usr/mail/$LOGNAME". .TP .B TERM The terminal type. Set to "network" so login scripts can test for this value and reset it appropriately. .TP .B RHOSTNAME The name of the remote host which connected to .I deslogind. This information is reliable only to the extent that the domain name system (DNS) and TCP are trustworthy. Use with caution. .PP Unlike rlogin, .I deslogind does not pass any environment variables, such as TERM, from the remote host. This is both a liability and a security feature. How much trust should the local host place in information derived from the remote host? Passing enviroment variables can be dangerous and complex. .SH MISSING FEATURES .PP A program to change passphrases, add, and delete users. .PP A better security method for the userFile should be designed. .SH ACKNOWLEDGEMENTS .PP Comments and improvements will be greatly appreciated and should be directed to the author: .PP David A. Barrett (barrett@asgard.cs.Colorado.EDU) .PP Copyright 1994 by David. A. Barrett. .PP This program is not to be distributed for profit or included in such software without written permission from the author. No permission is required for non-profit use. .SH FILES .ta 4i /usr/local/etc/deslogind.users default userFile .ta 4i /usr/adm/deslogind.log default log file .ta 4i /etc/services to determine TCP port .ta 4i /etc/nologin disabled login message .ta 4i /etc/passwd for user id, gid, home, shell .ta 4i /etc/group for supplementary group id's .ta 4i /etc/utmp active user sessions .ta 4i /etc/wtmp log of user sessions .ta 4i /dev/tty to get userFile cipherKey .ta 4i /dev/pty* session controlling terminal .ta 4i /bin/login program invoked by -w option .DT .SH SEE ALSO cipher(1), inetd(1m), rlogind(1), telnetd(1), deslogin(1), deslogingw(1), login(1). .\" index \fIdeslogind\fR \- DES authenticated encrypted login daemon\s-2DESLOGIN\s+1(1)\s+1 .\" .\" toc \s-2DESLOGIND\s+1(1)\s+1:\0\0\fIdeslogind\fR deslogin daemon plementary group id's .ta 4i /etc/utmp active user sessions .ta 4i /etc/wtmp log of user sessions .ta 4i /dev/tty to get userFile cipherKey .ta 4i /d