mirror of
git://anongit.mindrot.org/openssh.git
synced 2024-11-23 18:23:25 +08:00
- Added non-PAM MD5 password support patch from Tudor Bosman <tudorb@jm.nu>
This commit is contained in:
Damien Miller
parent
04f801456a
commit
dd1c7baf1a
@ -15,8 +15,9 @@
|
||||
- Added autoconf option to enable S/Key support (untested)
|
||||
- Added autoconf option to enable TCP wrappers support (compiles OK)
|
||||
- Renamed BSD helper function files to bsd-*
|
||||
- Added tests for login and daemon and OpenBSD replacements for when they
|
||||
are absent.
|
||||
- Added tests for login and daemon and enable OpenBSD replacements for
|
||||
when they are absent.
|
||||
- Added non-PAM MD5 password support patch from Tudor Bosman <tudorb@jm.nu>
|
||||
|
||||
19991118
|
||||
- Merged OpenBSD CVS changes
|
||||
|
||||
@ -27,7 +27,8 @@ OBJS= authfd.o authfile.o auth-passwd.o auth-rhosts.o auth-rh-rsa.o \
|
||||
hostfile.o log-client.o login.o log-server.o match.o mpaux.o \
|
||||
packet.o pty.o readconf.o readpass.o rsa.o servconf.o serverloop.o \
|
||||
sshconnect.o tildexpand.o ttymodes.o uidswap.o xmalloc.o \
|
||||
helper.o bsd-mktemp.o bsd-strlcpy.o bsd-daemon.o bsd-login.o rc4.o
|
||||
helper.o bsd-mktemp.o bsd-strlcpy.o bsd-daemon.o bsd-login.o rc4.o \
|
||||
md5crypt.o
|
||||
|
||||
all: $(OBJS) $(TARGETS)
|
||||
|
||||
@ -38,7 +39,7 @@ libssh.a: authfd.o authfile.o bufaux.o buffer.o canohost.o channels.o cipher.o c
|
||||
ssh: ssh.o sshconnect.o log-client.o readconf.o clientloop.o libssh.a
|
||||
$(CC) -o $@ $^ $(LFLAGS) $(LIBS)
|
||||
|
||||
sshd: sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o pty.o log-server.o login.o servconf.o serverloop.o bsd-login.o bsd-daemon.o libssh.a
|
||||
sshd: sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o pty.o log-server.o login.o servconf.o serverloop.o bsd-login.o bsd-daemon.o md5crypt.o libssh.a
|
||||
$(CC) -o $@ $^ $(LFLAGS) $(LIBS)
|
||||
|
||||
scp: scp.o libssh.a
|
||||
|
||||
@ -48,6 +48,9 @@
|
||||
/* Define if your libraries define daemon() */
|
||||
#undef HAVE_DAEMON
|
||||
|
||||
/* Define if you want to allow MD5 passwords */
|
||||
#undef HAVE_MD5_PASSWORDS
|
||||
|
||||
@BOTTOM@
|
||||
|
||||
/* ******************* Shouldn't need to edit below this line ************** */
|
||||
|
||||
@ -15,7 +15,10 @@ the password is valid for the user.
|
||||
*/
|
||||
|
||||
#include "includes.h"
|
||||
RCSID("$Id: auth-passwd.c,v 1.4 1999/11/13 04:40:10 damien Exp $");
|
||||
|
||||
#ifndef HAVE_PAM
|
||||
|
||||
RCSID("$Id: auth-passwd.c,v 1.5 1999/11/19 04:53:20 damien Exp $");
|
||||
|
||||
#include "packet.h"
|
||||
#include "ssh.h"
|
||||
@ -27,7 +30,10 @@ RCSID("$Id: auth-passwd.c,v 1.4 1999/11/13 04:40:10 damien Exp $");
|
||||
#include <shadow.h>
|
||||
#endif
|
||||
|
||||
#ifndef HAVE_PAM
|
||||
#ifdef HAVE_MD5_PASSWORDS
|
||||
#include "md5crypt.h"
|
||||
#endif
|
||||
|
||||
/* Don't need anything from here if we are using PAM */
|
||||
|
||||
/* Tries to authenticate the user using password. Returns true if
|
||||
@ -187,7 +193,14 @@ int auth_password(struct passwd *pw, const char *password)
|
||||
return(0);
|
||||
|
||||
/* Encrypt the candidate password using the proper salt. */
|
||||
#ifdef HAVE_MD5_PASSWORDS
|
||||
if (is_md5_salt(spw->sp_pwdp))
|
||||
encrypted_password = md5_crypt(password, spw->sp_pwdp);
|
||||
else
|
||||
encrypted_password = crypt(password, spw->sp_pwdp);
|
||||
#else /* HAVE_MD5_PASSWORDS */
|
||||
encrypted_password = crypt(password, spw->sp_pwdp);
|
||||
#endif /* HAVE_MD5_PASSWORDS */
|
||||
|
||||
/* Authentication is accepted if the encrypted passwords are identical. */
|
||||
return (strcmp(encrypted_password, spw->sp_pwdp) == 0);
|
||||
|
||||
@ -74,7 +74,7 @@ dnl Check whether use wants to disable the external ssh-askpass
|
||||
INSTALL_ASKPASS="yes"
|
||||
AC_MSG_CHECKING([whether to enable external ssh-askpass support])
|
||||
AC_ARG_WITH(askpass,
|
||||
[ --with-askpass=yes/no Enable external ssh-askpass support (default=no)],
|
||||
[ --with-askpass=yes/no Enable external ssh-askpass support (default=yes)],
|
||||
[
|
||||
if test x$withval = xno ; then
|
||||
INSTALL_ASKPASS="no"
|
||||
@ -213,4 +213,10 @@ AC_ARG_WITH(skey,
|
||||
]
|
||||
)
|
||||
|
||||
dnl Check whether to enable MD5 passwords
|
||||
AC_ARG_WITH(md5passwords,
|
||||
[ --with-md5-passwords Enable use of MD5 passwords],
|
||||
[AC_DEFINE(HAVE_MD5_PASSWORDS)]
|
||||
)
|
||||
|
||||
AC_OUTPUT(Makefile)
|
||||
|
||||
166
md5crypt.c
Normal file
166
md5crypt.c
Normal file
@ -0,0 +1,166 @@
|
||||
/*
|
||||
* ----------------------------------------------------------------------------
|
||||
* "THE BEER-WARE LICENSE" (Revision 42):
|
||||
* <phk@login.dknet.dk> wrote this file. As long as you retain this notice you
|
||||
* can do whatever you want with this stuff. If we meet some day, and you think
|
||||
* this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp
|
||||
* ----------------------------------------------------------------------------
|
||||
*/
|
||||
|
||||
/*
|
||||
* Ported from FreeBSD to Linux, only minimal changes. --marekm
|
||||
*/
|
||||
|
||||
/*
|
||||
* Adapted from shadow-19990607 by Tudor Bosman, tudorb@jm.nu
|
||||
*/
|
||||
|
||||
#include "config.h"
|
||||
|
||||
#ifdef HAVE_MD5_PASSWORDS
|
||||
|
||||
#include <unistd.h>
|
||||
#include <string.h>
|
||||
|
||||
#ifdef HAVE_OPENSSL
|
||||
#include <openssl/md5.h>
|
||||
#endif
|
||||
|
||||
#ifdef HAVE_SSL
|
||||
#include <ssl/md5.h>
|
||||
#endif
|
||||
|
||||
static unsigned char itoa64[] = /* 0 ... 63 => ascii - 64 */
|
||||
"./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
|
||||
|
||||
static char *magic = "$1$"; /*
|
||||
* This string is magic for
|
||||
* this algorithm. Having
|
||||
* it this way, we can get
|
||||
* get better later on
|
||||
*/
|
||||
|
||||
static void
|
||||
to64(char *s, unsigned long v, int n)
|
||||
{
|
||||
while (--n >= 0) {
|
||||
*s++ = itoa64[v&0x3f];
|
||||
v >>= 6;
|
||||
}
|
||||
}
|
||||
|
||||
int
|
||||
is_md5_salt(const char *salt)
|
||||
{
|
||||
return (!strncmp(salt, magic, strlen(magic)));
|
||||
}
|
||||
|
||||
/*
|
||||
* UNIX password
|
||||
*
|
||||
* Use MD5 for what it is best at...
|
||||
*/
|
||||
|
||||
char *
|
||||
md5_crypt(const char *pw, const char *salt)
|
||||
{
|
||||
static char passwd[120], *p;
|
||||
static const char *sp,*ep;
|
||||
unsigned char final[16];
|
||||
int sl,pl,i,j;
|
||||
MD5_CTX ctx,ctx1;
|
||||
unsigned long l;
|
||||
|
||||
/* Refine the Salt first */
|
||||
sp = salt;
|
||||
|
||||
/* If it starts with the magic string, then skip that */
|
||||
if(!strncmp(sp,magic,strlen(magic)))
|
||||
sp += strlen(magic);
|
||||
|
||||
/* It stops at the first '$', max 8 chars */
|
||||
for(ep=sp;*ep && *ep != '$' && ep < (sp+8);ep++)
|
||||
continue;
|
||||
|
||||
/* get the length of the true salt */
|
||||
sl = ep - sp;
|
||||
|
||||
MD5_Init(&ctx);
|
||||
|
||||
/* The password first, since that is what is most unknown */
|
||||
MD5_Update(&ctx,pw,strlen(pw));
|
||||
|
||||
/* Then our magic string */
|
||||
MD5_Update(&ctx,magic,strlen(magic));
|
||||
|
||||
/* Then the raw salt */
|
||||
MD5_Update(&ctx,sp,sl);
|
||||
|
||||
/* Then just as many characters of the MD5(pw,salt,pw) */
|
||||
MD5_Init(&ctx1);
|
||||
MD5_Update(&ctx1,pw,strlen(pw));
|
||||
MD5_Update(&ctx1,sp,sl);
|
||||
MD5_Update(&ctx1,pw,strlen(pw));
|
||||
MD5_Final(final,&ctx1);
|
||||
for(pl = strlen(pw); pl > 0; pl -= 16)
|
||||
MD5_Update(&ctx,final,pl>16 ? 16 : pl);
|
||||
|
||||
/* Don't leave anything around in vm they could use. */
|
||||
memset(final,0,sizeof final);
|
||||
|
||||
/* Then something really weird... */
|
||||
for (j=0,i = strlen(pw); i ; i >>= 1)
|
||||
if(i&1)
|
||||
MD5_Update(&ctx, final+j, 1);
|
||||
else
|
||||
MD5_Update(&ctx, pw+j, 1);
|
||||
|
||||
/* Now make the output string */
|
||||
strcpy(passwd,magic);
|
||||
strncat(passwd,sp,sl);
|
||||
strcat(passwd,"$");
|
||||
|
||||
MD5_Final(final,&ctx);
|
||||
|
||||
/*
|
||||
* and now, just to make sure things don't run too fast
|
||||
* On a 60 Mhz Pentium this takes 34 msec, so you would
|
||||
* need 30 seconds to build a 1000 entry dictionary...
|
||||
*/
|
||||
for(i=0;i<1000;i++) {
|
||||
MD5_Init(&ctx1);
|
||||
if(i & 1)
|
||||
MD5_Update(&ctx1,pw,strlen(pw));
|
||||
else
|
||||
MD5_Update(&ctx1,final,16);
|
||||
|
||||
if(i % 3)
|
||||
MD5_Update(&ctx1,sp,sl);
|
||||
|
||||
if(i % 7)
|
||||
MD5_Update(&ctx1,pw,strlen(pw));
|
||||
|
||||
if(i & 1)
|
||||
MD5_Update(&ctx1,final,16);
|
||||
else
|
||||
MD5_Update(&ctx1,pw,strlen(pw));
|
||||
MD5_Final(final,&ctx1);
|
||||
}
|
||||
|
||||
p = passwd + strlen(passwd);
|
||||
|
||||
l = (final[ 0]<<16) | (final[ 6]<<8) | final[12]; to64(p,l,4); p += 4;
|
||||
l = (final[ 1]<<16) | (final[ 7]<<8) | final[13]; to64(p,l,4); p += 4;
|
||||
l = (final[ 2]<<16) | (final[ 8]<<8) | final[14]; to64(p,l,4); p += 4;
|
||||
l = (final[ 3]<<16) | (final[ 9]<<8) | final[15]; to64(p,l,4); p += 4;
|
||||
l = (final[ 4]<<16) | (final[10]<<8) | final[ 5]; to64(p,l,4); p += 4;
|
||||
l = final[11] ; to64(p,l,2); p += 2;
|
||||
*p = '\0';
|
||||
|
||||
/* Don't leave anything around in vm they could use. */
|
||||
memset(final,0,sizeof final);
|
||||
|
||||
return passwd;
|
||||
}
|
||||
|
||||
#endif /* HAVE_MD5_PASSWORDS */
|
||||
37
md5crypt.h
Normal file
37
md5crypt.h
Normal file
@ -0,0 +1,37 @@
|
||||
/*
|
||||
* ----------------------------------------------------------------------------
|
||||
* "THE BEER-WARE LICENSE" (Revision 42):
|
||||
* <phk@login.dknet.dk> wrote this file. As long as you retain this notice you
|
||||
* can do whatever you want with this stuff. If we meet some day, and you think
|
||||
* this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp
|
||||
* ----------------------------------------------------------------------------
|
||||
*/
|
||||
|
||||
/*
|
||||
* Ported from FreeBSD to Linux, only minimal changes. --marekm
|
||||
*/
|
||||
|
||||
/*
|
||||
* Adapted from shadow-19990607 by Tudor Bosman, tudorb@jm.nu
|
||||
*/
|
||||
|
||||
#ifndef _MD5CRYPT_H
|
||||
#define _MD5CRYPT_H
|
||||
|
||||
#include "config.h"
|
||||
|
||||
#include <unistd.h>
|
||||
#include <string.h>
|
||||
|
||||
#ifdef HAVE_OPENSSL
|
||||
#include <openssl/md5.h>
|
||||
#endif
|
||||
|
||||
#ifdef HAVE_SSL
|
||||
#include <ssl/md5.h>
|
||||
#endif
|
||||
|
||||
int is_md5_salt(const char *salt);
|
||||
char *md5_crypt(const char *pw, const char *salt);
|
||||
|
||||
#endif /* MD5CRYPT_H */
|
||||
Loading…
Reference in New Issue
Block a user