auth.h revision 99046 
1/*	$OpenBSD: auth.h,v 1.39 2002/05/31 11:35:15 markus Exp $	*/
2/*	$FreeBSD: head/crypto/openssh/auth.h 99046 2002-06-29 10:44:37Z des $	*/
3
4/*
5 * Copyright (c) 2000 Markus Friedl.  All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in the
14 *    documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 *
27 */
28
29#ifndef AUTH_H
30#define AUTH_H
31
32#include "key.h"
33#include "hostfile.h"
34#include <openssl/rsa.h>
35
36#ifdef HAVE_LOGIN_CAP
37#include <login_cap.h>
38#endif
39#ifdef BSD_AUTH
40#include <bsd_auth.h>
41#endif
42#ifdef KRB5
43#include <krb5.h>
44#endif
45
46typedef struct Authctxt Authctxt;
47typedef struct Authmethod Authmethod;
48typedef struct KbdintDevice KbdintDevice;
49
50struct Authctxt {
51	int		 success;
52	int		 postponed;
53	int		 valid;
54	int		 attempt;
55	int		 failures;
56	char		*user;
57	char		*service;
58	struct passwd	*pw;
59	char		*style;
60	void		*kbdintctxt;
61#ifdef BSD_AUTH
62	auth_session_t	*as;
63#endif
64#ifdef KRB4
65	char		*krb4_ticket_file;
66#endif
67#ifdef KRB5
68	krb5_context	 krb5_ctx;
69	krb5_auth_context krb5_auth_ctx;
70	krb5_ccache	 krb5_fwd_ccache;
71	krb5_principal	 krb5_user;
72	char		*krb5_ticket_file;
73#endif
74};
75
76struct Authmethod {
77	char	*name;
78	int	(*userauth)(Authctxt *authctxt);
79	int	*enabled;
80};
81
82/*
83 * Keyboard interactive device:
84 * init_ctx	returns: non NULL upon success
85 * query	returns: 0 - success, otherwise failure
86 * respond	returns: 0 - success, 1 - need further interaction,
87 *		otherwise - failure
88 */
89struct KbdintDevice
90{
91	const char *name;
92	void*	(*init_ctx)(Authctxt*);
93	int	(*query)(void *ctx, char **name, char **infotxt,
94		    u_int *numprompts, char ***prompts, u_int **echo_on);
95	int	(*respond)(void *ctx, u_int numresp, char **responses);
96	void	(*free_ctx)(void *ctx);
97};
98
99int      auth_rhosts(struct passwd *, const char *);
100int
101auth_rhosts2(struct passwd *, const char *, const char *, const char *);
102
103int	 auth_rhosts_rsa(struct passwd *, char *, Key *);
104int      auth_password(Authctxt *, const char *);
105int      auth_rsa(struct passwd *, BIGNUM *);
106int      auth_rsa_challenge_dialog(Key *);
107BIGNUM	*auth_rsa_generate_challenge(Key *);
108int	 auth_rsa_verify_response(Key *, BIGNUM *, u_char[]);
109int	 auth_rsa_key_allowed(struct passwd *, BIGNUM *, Key **);
110
111int	 auth_rhosts_rsa_key_allowed(struct passwd *, char *, char *, Key *);
112int	 hostbased_key_allowed(struct passwd *, const char *, char *, Key *);
113int	 user_key_allowed(struct passwd *, Key *);
114
115#ifdef KRB4
116#include <krb.h>
117int     auth_krb4(Authctxt *, KTEXT, char **);
118int	auth_krb4_password(Authctxt *, const char *);
119void    krb4_cleanup_proc(void *);
120
121#ifdef AFS
122#include <kafs.h>
123int     auth_krb4_tgt(Authctxt *, const char *);
124int     auth_afs_token(Authctxt *, const char *);
125#endif /* AFS */
126
127#endif /* KRB4 */
128
129#ifdef KRB5
130int	auth_krb5(Authctxt *authctxt, krb5_data *auth, char **client);
131int	auth_krb5_tgt(Authctxt *authctxt, krb5_data *tgt);
132int	auth_krb5_password(Authctxt *authctxt, const char *password);
133void	krb5_cleanup_proc(void *authctxt);
134#endif /* KRB5 */
135
136#include "auth-pam.h"
137#include "auth2-pam.h"
138
139Authctxt *do_authentication(void);
140Authctxt *do_authentication2(void);
141
142Authctxt *authctxt_new(void);
143void	auth_log(Authctxt *, int, char *, char *);
144void	userauth_finish(Authctxt *, int, char *);
145int	auth_root_allowed(char *);
146
147char	*auth2_read_banner(void);
148
149void	privsep_challenge_enable(void);
150
151int	auth2_challenge(Authctxt *, char *);
152void	auth2_challenge_stop(Authctxt *);
153int	bsdauth_query(void *, char **, char **, u_int *, char ***, u_int **);
154int	bsdauth_respond(void *, u_int, char **);
155int	skey_query(void *, char **, char **, u_int *, char ***, u_int **);
156int	skey_respond(void *, u_int, char **);
157
158int	allowed_user(struct passwd *);
159struct passwd * getpwnamallow(const char *user);
160
161char	*get_challenge(Authctxt *);
162int	verify_response(Authctxt *, const char *);
163
164struct passwd * auth_get_user(void);
165
166char	*expand_filename(const char *, struct passwd *);
167char	*authorized_keys_file(struct passwd *);
168char	*authorized_keys_file2(struct passwd *);
169
170int
171secure_filename(FILE *, const char *, struct passwd *, char *, size_t);
172
173HostStatus
174check_key_in_hostfiles(struct passwd *, Key *, const char *,
175    const char *, const char *);
176
177/* hostkey handling */
178Key	*get_hostkey_by_index(int);
179Key	*get_hostkey_by_type(int);
180int	 get_hostkey_index(Key *);
181int	 ssh1_session_key(BIGNUM *);
182
183/* debug messages during authentication */
184void	 auth_debug_add(const char *fmt,...) __attribute__((format(printf, 1, 2)));
185void	 auth_debug_send(void);
186void	 auth_debug_reset(void);
187
188#define AUTH_FAIL_MAX 6
189#define AUTH_FAIL_LOG (AUTH_FAIL_MAX/2)
190#define AUTH_FAIL_MSG "Too many authentication failures for %.100s"
191
192#ifdef SKEY
193#ifdef OPIE
194#define SKEY_PROMPT "\nOPIE Password: "
195#else
196#define SKEY_PROMPT "\nS/Key Password: "
197#endif
198#endif
199
200#endif
201