root/pam_freeauth/pam_freeauth.c

#define USERSFILE "/etc/security/freeauth.conf"

#define STATFILE "/var/cache/freeauth"

/*
  secret   = init string created by #**#
  passcode = string user types in
  otp      = calculated by server, must match passcode
*/

#ifdef linux
#define LINUX
#endif

#define LEN_SECRET    16
#define LEN_PASSCODE  10
#define LEN_OTP        LEN_PASSCODE

#define MAX_DIFF 6


/* partly stolen from pam_pwdfile.c */

#include <stdio.h>
#include <stdarg.h>
#include <string.h>
#include <syslog.h>
#include <sys/stat.h>
#include <sys/mman.h>
#include <fcntl.h>

#include <security/pam_appl.h>

#define PAM_SM_AUTH
#define PAM_SM_PASSWORD
#include <security/pam_modules.h>

#ifdef SOLARIS
#define PAM_EXTERN
#endif

#ifdef LINUX
#include "md5.h"
#endif

#define TO_STR(str) TO_STR_2(str)
#define TO_STR_2(str) #str


// #define TRACE fprintf
#define TRACE //

#define BUFSIZE 256

#define _PAM_LOG if (!(flags & PAM_SILENT)) _pam_log
/* logging function ripped from pam_listfile.c */
void _pam_log(int err, const char *format, ...) {
  va_list args; 
  va_start(args, format);
  openlog("pam_freeauth", LOG_CONS|LOG_PID, LOG_AUTH);
  vsyslog(err, format, args);
  // vfprintf(stderr, format, args ); fputc('\n',stderr);
  va_end(args);
  closelog();
}

#define NOT_IMPLEMENTED(fct) \
     _pam_log (LOG_ERR, "error: " #fct " is not implemented by pam_freeauth")

PAM_EXTERN int pam_sm_open_session(pam_handle_t *pamh, int flags,
                                   int argc, const char **argv) {
  NOT_IMPLEMENTED (session management);
  return PAM_SERVICE_ERR;
}

PAM_EXTERN int pam_sm_close_session(pam_handle_t *pamh, int flags,
                                    int argc, const char **argv) {
  NOT_IMPLEMENTED (session management);
  return PAM_SERVICE_ERR;
}

PAM_EXTERN int pam_sm_acct_mgmt(pam_handle_t *pamh, int flags, 
                                int argc, const char **argv) {
  NOT_IMPLEMENTED (account management);
  return PAM_SERVICE_ERR;
}



PAM_EXTERN int pam_sm_authenticate(pam_handle_t *pamh, int flags,
                                   int argc, const char **argv) {    
  int retval, i;
  const char *usersfile = USERSFILE;
  const char *statfile = STATFILE;
  char secret[LEN_SECRET+1], passcode[LEN_PASSCODE+1];
  const char *user;
  char buffer [BUFSIZE+1];
  long unsigned int now;

  short debug = 0;
  short no_warn = 0;
  short use_first_pass = 0;
  short try_first_pass = 0;
  short not_set_pass = 0;

  char * getOTP64(long unsigned int now, char *secret) {
    unsigned char lookupChar[] = "123456789abcdefhkmnprstuvwxyzABCDEFGHKMNPQRSTUVWXYZ=+[]&@#*!-?%:";
    unsigned char md5sum[16];
    int i, tmp1 = 0, tmp2 = 0;
    snprintf ( buffer, BUFSIZE, "%0ld%s", now, secret);
#ifdef LINUX
    md5_buffer ( buffer, strlen(buffer), md5sum );
#else /* Solaris */
    md5_calc ( md5sum, buffer, strlen(buffer) );
#endif

    tmp1 = md5sum[0] >> 2;
    buffer[0] = lookupChar[tmp1 & 63];
    tmp2 = md5sum[0] - (tmp1 << 2);
    tmp1 = md5sum[1] >> 4;
    buffer[1] = lookupChar[(tmp1 + tmp2) & 63];
    tmp2 = md5sum[1] - (tmp1 << 4);
    tmp1 = md5sum[2] >> 6;
    buffer[2] = lookupChar[(tmp1 + tmp2) & 63];
    tmp2 = md5sum[2] - (tmp1 << 6);
    buffer[3] = lookupChar[tmp2 & 63];
    tmp1 = md5sum[3] >> 2;
    buffer[4] = lookupChar[tmp1 & 63];
    tmp2 = md5sum[3] - (tmp1 << 2);
    tmp1 = md5sum[4] >> 4;
    buffer[5] = lookupChar[(tmp1 + tmp2) & 63];
    tmp2 = md5sum[4] - (tmp1 << 4);
    tmp1 = md5sum[5] >> 6;
    buffer[6] = lookupChar[(tmp1 + tmp2) & 63];
    tmp2 = md5sum[5] - (tmp1 << 6);
    buffer[7] = lookupChar[tmp2 & 63];

    buffer[8] = 0;
    TRACE(stderr,"now=%ld, secret=%s, otp=%s\n",now,secret,buffer);
    return buffer;
  }
  
  char * getOTP32(long unsigned int now, char *secret) {
    unsigned char lookupChar[] = "0123456789abcdefghkmnoprstuvwxyz";
    unsigned char md5sum[16];
    int i, tmp1 = 0, tmp2 = 0;
    snprintf(buffer, BUFSIZE, "%0ld%s", now, secret);
#ifdef LINUX
    md5_buffer(buffer, strlen(buffer), md5sum);
#else /* Solaris */
    md5_calc(md5sum, buffer, strlen(buffer));
#endif

    tmp1 = md5sum[0] >> 3;
    buffer[0] = lookupChar[tmp1 & 31];
    tmp2 = md5sum[0] - (tmp1 << 3);
    tmp1 = md5sum[1] >> 6;
    buffer[1] = lookupChar[(tmp1 + tmp2) & 31];
    tmp2 = (md5sum[1] - (tmp1 << 6)) >> 1;
    buffer[2] = lookupChar[tmp2 & 31];
    tmp2 = md5sum[1] - ((md5sum[1] >> 1) << 1);
    tmp1 = md5sum[2] >> 4;
    buffer[3] = lookupChar[(tmp1 + tmp2) & 31];
    tmp2 = md5sum[2] - (tmp1 << 4);
    tmp1 = md5sum[3] >> 7;
    buffer[4] = lookupChar[(tmp1 + tmp2) & 31];
    tmp2 = (md5sum[3] - (tmp1 << 7)) >> 2;
    buffer[5] = lookupChar[tmp2 & 31];
    tmp2 = md5sum[3] - ((md5sum[3] - (tmp1 << 7)) >> 2) << 2;
    tmp1 = md5sum[4] >> 5;
    buffer[6] = lookupChar[(tmp1 + tmp2) & 31];
    tmp2 = md5sum[4] - (tmp1 << 5);
    buffer[7] = lookupChar[tmp2 & 31];
    tmp1 = md5sum[5] >> 3;
    buffer[8] = lookupChar[tmp1 & 31];
    tmp2 = md5sum[5] - (tmp1 << 3);
    tmp1 = md5sum[6] >> 6;
    buffer[9] = lookupChar[(tmp1 + tmp2) & 31];

    buffer[10] = 0;
    TRACE(stderr,"now=%ld, secret=%s, otp=%s\n",now,secret,buffer);
    return buffer;
  }
  
  /* read options */
  for (i=0; i<argc; i++) {  
    if (strncmp(argv[i],"users=",strlen("users="))==0) {
      usersfile = strchr( argv[i], '=');
      usersfile++;
    }
    else if (strncmp(argv[i],"cache=",strlen("cache="))==0) {
      statfile = strchr( argv[i], '=');
      statfile++;
    }
    else if (strcmp(argv[i],"debug")==0)
      debug=1;
    else if (strcmp(argv[i],"no_warn")==0)
      no_warn=1;
    else if (strcmp(argv[i],"use_first_pass")==0)
      use_first_pass=1;
    else if (strcmp(argv[i],"try_first_pass")==0)
      try_first_pass=1;
    else if (strcmp(argv[i],"not_set_pass")==0)
      not_set_pass=1;
    else
      _PAM_LOG(LOG_ERR,"option not implemented: %s",argv[i]);
  }


  /* read user name */
  if ((retval=pam_get_user(pamh,&user,NULL)) != PAM_SUCCESS) {
    _PAM_LOG(LOG_ERR, "error: get username");
    return retval;
  }
  TRACE(stderr,"USER: %s\n",user);
  

  /* get passcode */
 get_passcode:
  if (use_first_pass || try_first_pass) {
    char *p;
    retval = pam_get_item(pamh,PAM_AUTHTOK,(void *)&p);
    if (retval != PAM_SUCCESS) 
#ifdef LINUX
      return PAM_AUTHTOK_RECOVER_ERR;
#else /* Solaris */
      return PAM_AUTHINFO_UNAVAIL;
#endif
    if (p) { strncpy(passcode, p ,LEN_PASSCODE); passcode[LEN_PASSCODE]=0; }
    TRACE(stderr,"old passcode: %s\n",passcode);
    if (debug) _PAM_LOG(LOG_DEBUG, "using old passcode (%s)",
                        use_first_pass?"use_first_pass":"try_first_pass");
  }
  else {
    struct pam_message msg, *pmsg[1];
    struct pam_response *resp;
    struct pam_conv *conv;
    msg.msg = "passcode: ";
    msg.msg_style = PAM_PROMPT_ECHO_OFF;
    pmsg[0] = &msg;
    
    retval = pam_get_item (pamh, PAM_CONV, (const void **) &conv);
    if (retval != PAM_SUCCESS) return retval;
    retval = conv->conv (1, (const struct pam_message **)pmsg, &resp, conv->appdata_ptr);
    if (retval != PAM_SUCCESS) return retval;
    if (!resp) return PAM_CONV_ERR;
    strncpy(passcode, resp->resp ,LEN_PASSCODE); passcode[LEN_PASSCODE]=0;
    if (resp) free (resp);
    if (!not_set_pass) pam_set_item (pamh, PAM_AUTHTOK, &passcode);
  }
  TRACE(stderr,"user: %s, passcode: %s\n", user, passcode);
  
  
  /* read secret from users file */
  { 
    FILE *fp;
    char name[BUFSIZE+1]; name[0]=0;
    if ( (fp=fopen(usersfile,"r")) == NULL ) {
      _PAM_LOG(LOG_ALERT, "error: cannot open usersfile %s",usersfile);
      return PAM_AUTHINFO_UNAVAIL; 
    }
    while (fgets(buffer,BUFSIZE,fp)) {
      if ( (buffer[0]=='#') || (buffer[0]==0) ) continue;
      buffer[BUFSIZE]=0;
      TRACE(stderr,"buffer=%s\n",buffer);
      retval = sscanf(buffer, "%s\t%s", &name, &secret);
      if (retval < 2) continue;
      TRACE(stderr,"trying: user: %s, secret: %s -- user: %s\n", name, secret, user);
      if ( strcmp(user,name)==0 ) break; 
    }
    if ( fclose(fp) ) if (!no_warn) 
      _PAM_LOG(LOG_INFO, "warning: cannot close usersfile %s",usersfile);
    if ( strcmp(user,name) ) {
      _PAM_LOG(LOG_INFO, "user %s not found in file %s", user,usersfile);
      return PAM_USER_UNKNOWN;
    }
    TRACE(stderr,"user: %s, secret: %s\n", name, secret);
    if (debug) _PAM_LOG(LOG_DEBUG, "user: %s", name);
  }
  
  
  /* passcode ok? */
  retval=PAM_AUTH_ERR;
  now = time(NULL);      
  now /= 60;
  now -= MAX_DIFF/2;
  i = now + MAX_DIFF;
  if (debug) _PAM_LOG(LOG_NOTICE, passcode);
  if (debug) _PAM_LOG(LOG_NOTICE, secret);
  for ( ; now <= i ; now++ )
  {
    if(strlen(passcode) == 8)
    {
      if (debug) _PAM_LOG(LOG_NOTICE, getOTP64(now,secret));
      if (strcmp(passcode,getOTP64(now,secret))==0) {
        if (debug) _PAM_LOG(LOG_DEBUG, "passcode accepted");
        retval=PAM_SUCCESS;
        break;
      }
    } else {
      if (debug) _PAM_LOG(LOG_NOTICE, getOTP32(now,secret));
      if (strcmp(passcode,getOTP32(now,secret))==0) {
        if (debug) _PAM_LOG(LOG_DEBUG, "passcode accepted");
        retval=PAM_SUCCESS;
        break;
      }
    }
  }
  if ( (retval!=PAM_SUCCESS) && (try_first_pass) ) {
    TRACE(stderr,"trying without \"try_first_pass\"\n");
    try_first_pass = 0;
    goto get_passcode;
  }
  if (retval!=PAM_SUCCESS) _PAM_LOG(LOG_NOTICE, "passcode not accepted");
  TRACE (stderr, "passcode %saccepted: %s\n", (retval==PAM_SUCCESS?"":"not "), passcode);
  

  /* read and write user's status file */
  {
    FILE *fp;
    int tries = 0;
    long unsigned int last_time = 0;
    
    snprintf(buffer,BUFSIZE,"%s/%s",statfile,user);
    buffer[BUFSIZE]=0;
    statfile=buffer;
    if ( (fp=fopen(statfile,"r")) == NULL ) {
      if (debug) _PAM_LOG(LOG_DEBUG, "user %s has no statfile",user);
      tries = last_time = 0;
    }
    else {
      if ( fscanf(fp,"%d:%lu:%*s",&tries,&last_time) != 2 ) {
        _PAM_LOG(LOG_INFO, "cannot read data from statfile",statfile);
        fclose(fp);
        return PAM_AUTHINFO_UNAVAIL;
      }
      tries = 0;
      if (debug) _PAM_LOG(LOG_DEBUG, "user has tries: %d, last time: %lu", tries, last_time);
      if ( fclose(fp) ) if (!no_warn)
        _PAM_LOG(LOG_INFO, "warning: cannot close file (r) %s",statfile);
    }
    
    if (!(now>last_time))  // check of replays
      retval=PAM_AUTH_ERR;
    if (retval == PAM_SUCCESS)  // reset tries
      { tries = 0; last_time = now; }
    else
      tries ++;
    
    umask(077);
    if ( (fp=fopen(statfile,"w")) == NULL ) {
      _PAM_LOG(LOG_ERR, "cannot write statfile %s",statfile);
      return PAM_AUTHINFO_UNAVAIL;
    }
    if ( fprintf(fp,"%d:%lu:%s\n",tries,last_time,"") < 0 ) {
      _PAM_LOG(LOG_INFO, "cannot write new statfile %s",statfile);
      retval = PAM_AUTHINFO_UNAVAIL;
    }
    TRACE(stderr,"written new stats - tries: %d, last time: %lu\n",tries,last_time);
    if ( fclose(fp) ) if (!no_warn)
      _PAM_LOG(LOG_INFO, "warning: cannot close file (w) %s",statfile);
  }
  

  /* return pam code */
  return retval;
}


PAM_EXTERN int pam_sm_setcred(pam_handle_t *pamh, int flags,
                              int argc, const char **argv)
{
  return PAM_SUCCESS;
}


PAM_EXTERN int pam_sm_chauthtok(pam_handle_t *pamh, int flags, 
                                int argc, const char **argv) {
  
  /*
    Function is not thread save at the moment.
    Moreover, changing usersfile while user changes secret is problematic.
    User must not type in old secret :-( 
  */
  
  int retval, i;
  const char *usersfile = USERSFILE;
  char SECRET[LEN_SECRET+1];
  const char *user;
  char buffer[BUFSIZE+1], name[BUFSIZE+1];
  int pos = 0;
  FILE *fp;
  
  short debug = 0;
  short no_warn = 0;
  short use_first_pass = 0;
  short try_first_pass = 0;
  short not_set_pass = 0;

  /* read options */
  for (i=0; i<argc; i++) {
    if (strncmp(argv[i],"users=",strlen("users="))==0) {
      usersfile = strchr( argv[i], '=');
      usersfile++;
    }
    else if (strcmp(argv[i],"debug")==0)
      debug=1;
    else if (strcmp(argv[i],"no_warn")==0)
      no_warn=1;
    else
      _PAM_LOG(LOG_ERR,"option not implemented: %s",argv[i]);
  }
  
  
  /* read user name */
  if ((retval=pam_get_user(pamh,&user,NULL)) != PAM_SUCCESS) {
    _PAM_LOG(LOG_ERR, "error: get username");
    return retval;
  }

  if (debug) _PAM_LOG(LOG_DEBUG, "user %s tries to change SECRET - %s",
                      user, (flags & PAM_PRELIM_CHECK) ? "1st run" : "2nd run" );

  if (flags & PAM_PRELIM_CHECK) {
    /* read secret from users file */
    {
      char *p;
      name[0]=0;
      if ( (fp=fopen(usersfile,"r")) == NULL ) {
        _PAM_LOG(LOG_ALERT, "error: cannot open usersfile %s",usersfile);
        return PAM_TRY_AGAIN;
      }
      while (fgets(buffer,BUFSIZE,fp)) {
        pos += strlen(buffer);
        if ( (buffer[0]=='#') || (buffer[0]==0) ) continue;
        buffer[BUFSIZE]=0;
        if ( !sscanf(buffer, "%s\t%s", &name, &SECRET)) continue;
        if ( strcmp(user,name)==0 ) break;
      }
      if ( fclose(fp) ) if (!no_warn)
        _PAM_LOG(LOG_INFO, "warning: cannot close usersfile %s",usersfile);
      if ( strcmp(user,name) ) {
        _PAM_LOG(LOG_INFO, "user %s not found in file %s", user,usersfile);
        pos=0;
        return PAM_USER_UNKNOWN;
      }
      pos -= strlen(buffer);
      p=buffer;
      while ( p && (! isspace(*p)) ) p++;  // skip name
      while ( p &&    isspace(*p)  ) p++;  // skip gap
      pos += (p-buffer);
      retval = pam_set_data (pamh, "freeauth-position", (void *)pos, NULL);
      if (retval != PAM_SUCCESS) return PAM_TRY_AGAIN;
      TRACE(stderr,"position: %d\n",pos);
    }
    return PAM_SUCCESS;
  }


  /* get new SECRET */
  {
    struct pam_message msg, *pmsg[1];
    struct pam_response *resp;
    struct pam_conv *conv;
    int tries = 0;

    void message ( pam_handle_t *pamh, char *str ) {
      msg.msg_style = PAM_ERROR_MSG;
      msg.msg = str;
      retval = pam_get_item (pamh, PAM_CONV, (const void **) &conv);
      if (retval != PAM_SUCCESS) return;
      retval = conv->conv (1, (const struct pam_message **)pmsg,
                           &resp, conv->appdata_ptr);
      if (resp) free (resp);
    }

    pmsg[0] = &msg;

  new_secret:
    if (++tries > 3) return PAM_AUTHTOK_ERR;

    msg.msg_style = PAM_PROMPT_ECHO_OFF;
    msg.msg = "new SECRET: ";
    retval = pam_get_item (pamh, PAM_CONV, (const void **) &conv);
    if (retval != PAM_SUCCESS) return retval;
    retval = conv->conv (1, (const struct pam_message **)pmsg, &resp, conv->appdata_ptr);
    if (retval != PAM_SUCCESS) return retval;
    if (!resp) return PAM_CONV_ERR;
    strncpy(SECRET, resp->resp ,LEN_SECRET); SECRET[LEN_SECRET]=0;

    if ( strlen(resp->resp) > 16 )
      message(pamh, "SECRET will be truncated to 16 characters");
    free (resp);

    if (strlen(SECRET)<16) {
      message(pamh, "SECRET must be 16 characters long -- please retry\n");
      goto new_secret;
    }

    msg.msg_style = PAM_PROMPT_ECHO_OFF;
    msg.msg = "new SECRET again: ";
    pmsg[0] = &msg;
    retval = pam_get_item (pamh, PAM_CONV, (const void **) &conv);
    if (retval != PAM_SUCCESS) return retval;
    retval = conv->conv (1, (const struct pam_message **)pmsg, &resp, conv->appdata_ptr);
    if (retval != PAM_SUCCESS) return retval;
    if (!resp) return PAM_CONV_ERR;

    if ( strlen(resp->resp) > 16 )
      message(pamh, "SECRET will be truncated to 16 characters");
    
    if ( strncmp(SECRET, resp->resp, strlen(SECRET)) ) {
      free (resp);
      message(pamh, "SECRETs are different -- please retry");
      goto new_secret;
    }
    free (resp);
  }
  

  /* open usersfile for writing and change SECRET */
  retval = pam_get_data (pamh, "freeauth-position", (const void **) &pos);
  if (retval != PAM_SUCCESS) return retval;
  if ( (fp=fopen(usersfile,"r+")) == NULL ) {
    _PAM_LOG(LOG_ALERT, "error: cannot open usersfile %s",usersfile);
    return PAM_PERM_DENIED;
  }
  TRACE(stderr,"position: %d\n",pos);
  for (;pos--;) if (fgetc(fp)==EOF) return PAM_PERM_DENIED;
  fflush(fp);
  if ( fputs(SECRET,fp) == EOF ) return PAM_PERM_DENIED;
  if ( fclose(fp) ) if (!no_warn)
    _PAM_LOG(LOG_INFO, "warning: cannot close usersfile %s",usersfile);
  
  if (debug) _PAM_LOG(LOG_DEBUG, "SECRET changed" );
  return PAM_SUCCESS;
}


#ifdef PAM_STATIC
struct pam_module _pam_freeauth_modstruct = {
  "pam_freeauth",
  pam_sm_authenticate,
  pam_sm_setcred,
  NULL,
  NULL,
  NULL,
  pam_sm_chauthtok,
};
#endif