Ed Tanous | 911ac31 | 2017-08-15 09:37:42 -0700 | [diff] [blame] | 1 | #pragma once |
| 2 | |
Ed Tanous | f3d847c | 2017-06-12 16:01:42 -0700 | [diff] [blame] | 3 | #include <security/pam_appl.h> |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 4 | |
| 5 | #include <boost/utility/string_view.hpp> |
Ed Tanous | 911ac31 | 2017-08-15 09:37:42 -0700 | [diff] [blame] | 6 | #include <cstring> |
Ed Tanous | e0d918b | 2018-03-27 17:41:04 -0700 | [diff] [blame] | 7 | #include <memory> |
Ed Tanous | f3d847c | 2017-06-12 16:01:42 -0700 | [diff] [blame] | 8 | |
| 9 | // function used to get user input |
Ed Tanous | 55c7b7a | 2018-05-22 15:27:24 -0700 | [diff] [blame] | 10 | inline int pamFunctionConversation(int numMsg, const struct pam_message** msg, |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 11 | struct pam_response** resp, void* appdataPtr) |
| 12 | { |
| 13 | if (appdataPtr == nullptr) |
| 14 | { |
| 15 | return PAM_AUTH_ERR; |
| 16 | } |
Ed Tanous | f1eebf0 | 2019-03-04 15:57:09 -0800 | [diff] [blame] | 17 | char* appPass = reinterpret_cast<char*>(appdataPtr); |
| 18 | size_t appPassSize = std::strlen(appPass); |
| 19 | char* pass = reinterpret_cast<char*>(malloc(appPassSize + 1)); |
Ed Tanous | 39e7750 | 2019-03-04 17:35:53 -0800 | [diff] [blame^] | 20 | if (pass == nullptr) |
Ed Tanous | f1eebf0 | 2019-03-04 15:57:09 -0800 | [diff] [blame] | 21 | { |
| 22 | return PAM_AUTH_ERR; |
| 23 | } |
| 24 | |
| 25 | std::strcpy(pass, appPass); |
Ed Tanous | f3d847c | 2017-06-12 16:01:42 -0700 | [diff] [blame] | 26 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 27 | *resp = reinterpret_cast<pam_response*>( |
| 28 | calloc(numMsg, sizeof(struct pam_response))); |
Ed Tanous | f3d847c | 2017-06-12 16:01:42 -0700 | [diff] [blame] | 29 | |
Ed Tanous | 39e7750 | 2019-03-04 17:35:53 -0800 | [diff] [blame^] | 30 | if (resp == nullptr) |
Ed Tanous | f1eebf0 | 2019-03-04 15:57:09 -0800 | [diff] [blame] | 31 | { |
| 32 | return PAM_AUTH_ERR; |
| 33 | } |
| 34 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 35 | for (int i = 0; i < numMsg; ++i) |
| 36 | { |
| 37 | /* Ignore all PAM messages except prompting for hidden input */ |
| 38 | if (msg[i]->msg_style != PAM_PROMPT_ECHO_OFF) |
| 39 | { |
| 40 | continue; |
| 41 | } |
| 42 | |
| 43 | /* Assume PAM is only prompting for the password as hidden input */ |
| 44 | resp[i]->resp = pass; |
Ed Tanous | 911ac31 | 2017-08-15 09:37:42 -0700 | [diff] [blame] | 45 | } |
Ed Tanous | f3d847c | 2017-06-12 16:01:42 -0700 | [diff] [blame] | 46 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 47 | return PAM_SUCCESS; |
Ed Tanous | f3d847c | 2017-06-12 16:01:42 -0700 | [diff] [blame] | 48 | } |
| 49 | |
Ed Tanous | 39e7750 | 2019-03-04 17:35:53 -0800 | [diff] [blame^] | 50 | inline bool pamAuthenticateUser(const std::string_view username, |
| 51 | const std::string_view password) |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 52 | { |
| 53 | std::string userStr(username); |
| 54 | std::string passStr(password); |
| 55 | const struct pam_conv localConversation = { |
| 56 | pamFunctionConversation, const_cast<char*>(passStr.c_str())}; |
| 57 | pam_handle_t* localAuthHandle = NULL; // this gets set by pam_start |
Ed Tanous | f3d847c | 2017-06-12 16:01:42 -0700 | [diff] [blame] | 58 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 59 | if (pam_start("webserver", userStr.c_str(), &localConversation, |
| 60 | &localAuthHandle) != PAM_SUCCESS) |
| 61 | { |
| 62 | return false; |
Ed Tanous | 911ac31 | 2017-08-15 09:37:42 -0700 | [diff] [blame] | 63 | } |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 64 | int retval = pam_authenticate(localAuthHandle, |
| 65 | PAM_SILENT | PAM_DISALLOW_NULL_AUTHTOK); |
Ed Tanous | 911ac31 | 2017-08-15 09:37:42 -0700 | [diff] [blame] | 66 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 67 | if (retval != PAM_SUCCESS) |
| 68 | { |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 69 | pam_end(localAuthHandle, PAM_SUCCESS); |
| 70 | return false; |
| 71 | } |
Ed Tanous | 911ac31 | 2017-08-15 09:37:42 -0700 | [diff] [blame] | 72 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 73 | /* check that the account is healthy */ |
| 74 | if (pam_acct_mgmt(localAuthHandle, PAM_DISALLOW_NULL_AUTHTOK) != |
| 75 | PAM_SUCCESS) |
| 76 | { |
| 77 | pam_end(localAuthHandle, PAM_SUCCESS); |
| 78 | return false; |
| 79 | } |
Ed Tanous | 911ac31 | 2017-08-15 09:37:42 -0700 | [diff] [blame] | 80 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 81 | if (pam_end(localAuthHandle, PAM_SUCCESS) != PAM_SUCCESS) |
| 82 | { |
| 83 | return false; |
| 84 | } |
| 85 | |
| 86 | return true; |
Ed Tanous | 911ac31 | 2017-08-15 09:37:42 -0700 | [diff] [blame] | 87 | } |
Ed Tanous | a840879 | 2018-09-05 16:08:38 -0700 | [diff] [blame] | 88 | |
| 89 | inline bool pamUpdatePassword(const std::string& username, |
| 90 | const std::string& password) |
| 91 | { |
| 92 | const struct pam_conv localConversation = { |
| 93 | pamFunctionConversation, const_cast<char*>(password.c_str())}; |
| 94 | pam_handle_t* localAuthHandle = NULL; // this gets set by pam_start |
| 95 | |
| 96 | if (pam_start("passwd", username.c_str(), &localConversation, |
| 97 | &localAuthHandle) != PAM_SUCCESS) |
| 98 | { |
| 99 | return false; |
| 100 | } |
| 101 | int retval = pam_chauthtok(localAuthHandle, PAM_SILENT); |
| 102 | |
| 103 | if (retval != PAM_SUCCESS) |
| 104 | { |
| 105 | pam_end(localAuthHandle, PAM_SUCCESS); |
| 106 | return false; |
| 107 | } |
| 108 | |
| 109 | if (pam_end(localAuthHandle, PAM_SUCCESS) != PAM_SUCCESS) |
| 110 | { |
| 111 | return false; |
| 112 | } |
| 113 | |
| 114 | return true; |
| 115 | } |