diff options
| -rw-r--r-- | ChangeLog | 5 | ||||
| -rw-r--r-- | Makefile.in | 5 | ||||
| -rw-r--r-- | acconfig.h | 3 | ||||
| -rw-r--r-- | auth-passwd.c | 17 | ||||
| -rw-r--r-- | configure.in | 8 | ||||
| -rw-r--r-- | md5crypt.c | 166 | ||||
| -rw-r--r-- | md5crypt.h | 37 |
7 files changed, 234 insertions, 7 deletions
@@ -15,8 +15,9 @@ - Added autoconf option to enable S/Key support (untested) - Added autoconf option to enable TCP wrappers support (compiles OK) - Renamed BSD helper function files to bsd-* - - Added tests for login and daemon and OpenBSD replacements for when they - are absent. + - Added tests for login and daemon and enable OpenBSD replacements for + when they are absent. + - Added non-PAM MD5 password support patch from Tudor Bosman <tudorb@jm.nu> 19991118 - Merged OpenBSD CVS changes diff --git a/Makefile.in b/Makefile.in index fec1d130..dde1353f 100644 --- a/Makefile.in +++ b/Makefile.in @@ -27,7 +27,8 @@ OBJS= authfd.o authfile.o auth-passwd.o auth-rhosts.o auth-rh-rsa.o \ hostfile.o log-client.o login.o log-server.o match.o mpaux.o \ packet.o pty.o readconf.o readpass.o rsa.o servconf.o serverloop.o \ sshconnect.o tildexpand.o ttymodes.o uidswap.o xmalloc.o \ - helper.o bsd-mktemp.o bsd-strlcpy.o bsd-daemon.o bsd-login.o rc4.o + helper.o bsd-mktemp.o bsd-strlcpy.o bsd-daemon.o bsd-login.o rc4.o \ + md5crypt.o all: $(OBJS) $(TARGETS) @@ -38,7 +39,7 @@ libssh.a: authfd.o authfile.o bufaux.o buffer.o canohost.o channels.o cipher.o c ssh: ssh.o sshconnect.o log-client.o readconf.o clientloop.o libssh.a $(CC) -o $@ $^ $(LFLAGS) $(LIBS) -sshd: sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o pty.o log-server.o login.o servconf.o serverloop.o bsd-login.o bsd-daemon.o libssh.a +sshd: sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o pty.o log-server.o login.o servconf.o serverloop.o bsd-login.o bsd-daemon.o md5crypt.o libssh.a $(CC) -o $@ $^ $(LFLAGS) $(LIBS) scp: scp.o libssh.a @@ -48,6 +48,9 @@ /* Define if your libraries define daemon() */ #undef HAVE_DAEMON +/* Define if you want to allow MD5 passwords */ +#undef HAVE_MD5_PASSWORDS + @BOTTOM@ /* ******************* Shouldn't need to edit below this line ************** */ diff --git a/auth-passwd.c b/auth-passwd.c index ea824f5f..a08bab3a 100644 --- a/auth-passwd.c +++ b/auth-passwd.c @@ -15,7 +15,10 @@ the password is valid for the user. */ #include "includes.h" -RCSID("$Id: auth-passwd.c,v 1.4 1999/11/13 04:40:10 damien Exp $"); + +#ifndef HAVE_PAM + +RCSID("$Id: auth-passwd.c,v 1.5 1999/11/19 04:53:20 damien Exp $"); #include "packet.h" #include "ssh.h" @@ -27,7 +30,10 @@ RCSID("$Id: auth-passwd.c,v 1.4 1999/11/13 04:40:10 damien Exp $"); #include <shadow.h> #endif -#ifndef HAVE_PAM +#ifdef HAVE_MD5_PASSWORDS +#include "md5crypt.h" +#endif + /* Don't need anything from here if we are using PAM */ /* Tries to authenticate the user using password. Returns true if @@ -187,7 +193,14 @@ int auth_password(struct passwd *pw, const char *password) return(0); /* Encrypt the candidate password using the proper salt. */ +#ifdef HAVE_MD5_PASSWORDS + if (is_md5_salt(spw->sp_pwdp)) + encrypted_password = md5_crypt(password, spw->sp_pwdp); + else + encrypted_password = crypt(password, spw->sp_pwdp); +#else /* HAVE_MD5_PASSWORDS */ encrypted_password = crypt(password, spw->sp_pwdp); +#endif /* HAVE_MD5_PASSWORDS */ /* Authentication is accepted if the encrypted passwords are identical. */ return (strcmp(encrypted_password, spw->sp_pwdp) == 0); diff --git a/configure.in b/configure.in index dd74b3b4..697784c6 100644 --- a/configure.in +++ b/configure.in @@ -74,7 +74,7 @@ dnl Check whether use wants to disable the external ssh-askpass INSTALL_ASKPASS="yes" AC_MSG_CHECKING([whether to enable external ssh-askpass support]) AC_ARG_WITH(askpass, - [ --with-askpass=yes/no Enable external ssh-askpass support (default=no)], + [ --with-askpass=yes/no Enable external ssh-askpass support (default=yes)], [ if test x$withval = xno ; then INSTALL_ASKPASS="no" @@ -213,4 +213,10 @@ AC_ARG_WITH(skey, ] ) +dnl Check whether to enable MD5 passwords +AC_ARG_WITH(md5passwords, + [ --with-md5-passwords Enable use of MD5 passwords], + [AC_DEFINE(HAVE_MD5_PASSWORDS)] +) + AC_OUTPUT(Makefile) diff --git a/md5crypt.c b/md5crypt.c new file mode 100644 index 00000000..15af422a --- /dev/null +++ b/md5crypt.c @@ -0,0 +1,166 @@ +/* + * ---------------------------------------------------------------------------- + * "THE BEER-WARE LICENSE" (Revision 42): + * <phk@login.dknet.dk> wrote this file. As long as you retain this notice you + * can do whatever you want with this stuff. If we meet some day, and you think + * this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp + * ---------------------------------------------------------------------------- + */ + +/* + * Ported from FreeBSD to Linux, only minimal changes. --marekm + */ + +/* + * Adapted from shadow-19990607 by Tudor Bosman, tudorb@jm.nu + */ + +#include "config.h" + +#ifdef HAVE_MD5_PASSWORDS + +#include <unistd.h> +#include <string.h> + +#ifdef HAVE_OPENSSL +#include <openssl/md5.h> +#endif + +#ifdef HAVE_SSL +#include <ssl/md5.h> +#endif + +static unsigned char itoa64[] = /* 0 ... 63 => ascii - 64 */ + "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"; + +static char *magic = "$1$"; /* + * This string is magic for + * this algorithm. Having + * it this way, we can get + * get better later on + */ + +static void +to64(char *s, unsigned long v, int n) +{ + while (--n >= 0) { + *s++ = itoa64[v&0x3f]; + v >>= 6; + } +} + +int +is_md5_salt(const char *salt) +{ + return (!strncmp(salt, magic, strlen(magic))); +} + +/* + * UNIX password + * + * Use MD5 for what it is best at... + */ + +char * +md5_crypt(const char *pw, const char *salt) +{ + static char passwd[120], *p; + static const char *sp,*ep; + unsigned char final[16]; + int sl,pl,i,j; + MD5_CTX ctx,ctx1; + unsigned long l; + + /* Refine the Salt first */ + sp = salt; + + /* If it starts with the magic string, then skip that */ + if(!strncmp(sp,magic,strlen(magic))) + sp += strlen(magic); + + /* It stops at the first '$', max 8 chars */ + for(ep=sp;*ep && *ep != '$' && ep < (sp+8);ep++) + continue; + + /* get the length of the true salt */ + sl = ep - sp; + + MD5_Init(&ctx); + + /* The password first, since that is what is most unknown */ + MD5_Update(&ctx,pw,strlen(pw)); + + /* Then our magic string */ + MD5_Update(&ctx,magic,strlen(magic)); + + /* Then the raw salt */ + MD5_Update(&ctx,sp,sl); + + /* Then just as many characters of the MD5(pw,salt,pw) */ + MD5_Init(&ctx1); + MD5_Update(&ctx1,pw,strlen(pw)); + MD5_Update(&ctx1,sp,sl); + MD5_Update(&ctx1,pw,strlen(pw)); + MD5_Final(final,&ctx1); + for(pl = strlen(pw); pl > 0; pl -= 16) + MD5_Update(&ctx,final,pl>16 ? 16 : pl); + + /* Don't leave anything around in vm they could use. */ + memset(final,0,sizeof final); + + /* Then something really weird... */ + for (j=0,i = strlen(pw); i ; i >>= 1) + if(i&1) + MD5_Update(&ctx, final+j, 1); + else + MD5_Update(&ctx, pw+j, 1); + + /* Now make the output string */ + strcpy(passwd,magic); + strncat(passwd,sp,sl); + strcat(passwd,"$"); + + MD5_Final(final,&ctx); + + /* + * and now, just to make sure things don't run too fast + * On a 60 Mhz Pentium this takes 34 msec, so you would + * need 30 seconds to build a 1000 entry dictionary... + */ + for(i=0;i<1000;i++) { + MD5_Init(&ctx1); + if(i & 1) + MD5_Update(&ctx1,pw,strlen(pw)); + else + MD5_Update(&ctx1,final,16); + + if(i % 3) + MD5_Update(&ctx1,sp,sl); + + if(i % 7) + MD5_Update(&ctx1,pw,strlen(pw)); + + if(i & 1) + MD5_Update(&ctx1,final,16); + else + MD5_Update(&ctx1,pw,strlen(pw)); + MD5_Final(final,&ctx1); + } + + p = passwd + strlen(passwd); + + l = (final[ 0]<<16) | (final[ 6]<<8) | final[12]; to64(p,l,4); p += 4; + l = (final[ 1]<<16) | (final[ 7]<<8) | final[13]; to64(p,l,4); p += 4; + l = (final[ 2]<<16) | (final[ 8]<<8) | final[14]; to64(p,l,4); p += 4; + l = (final[ 3]<<16) | (final[ 9]<<8) | final[15]; to64(p,l,4); p += 4; + l = (final[ 4]<<16) | (final[10]<<8) | final[ 5]; to64(p,l,4); p += 4; + l = final[11] ; to64(p,l,2); p += 2; + *p = '\0'; + + /* Don't leave anything around in vm they could use. */ + memset(final,0,sizeof final); + + return passwd; +} + +#endif /* HAVE_MD5_PASSWORDS */ diff --git a/md5crypt.h b/md5crypt.h new file mode 100644 index 00000000..f1d18572 --- /dev/null +++ b/md5crypt.h @@ -0,0 +1,37 @@ +/* + * ---------------------------------------------------------------------------- + * "THE BEER-WARE LICENSE" (Revision 42): + * <phk@login.dknet.dk> wrote this file. As long as you retain this notice you + * can do whatever you want with this stuff. If we meet some day, and you think + * this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp + * ---------------------------------------------------------------------------- + */ + +/* + * Ported from FreeBSD to Linux, only minimal changes. --marekm + */ + +/* + * Adapted from shadow-19990607 by Tudor Bosman, tudorb@jm.nu + */ + +#ifndef _MD5CRYPT_H +#define _MD5CRYPT_H + +#include "config.h" + +#include <unistd.h> +#include <string.h> + +#ifdef HAVE_OPENSSL +#include <openssl/md5.h> +#endif + +#ifdef HAVE_SSL +#include <ssl/md5.h> +#endif + +int is_md5_salt(const char *salt); +char *md5_crypt(const char *pw, const char *salt); + +#endif /* MD5CRYPT_H */ |