projects / unix-history / blobdiff
? search:
summary | tags | clone url | shortlog | log | commit | commitdiff | tree
raw | inline | side by side
don't do duplicate ROOT login logs from rlogind w/ kerberos
[unix-history] / usr / src / usr.bin / login / login.c
diff --git a/usr/src/usr.bin/login/login.c b/usr/src/usr.bin/login/login.c
index f075acf..97503f1 100644 (file)
--- a/usr/src/usr.bin/login/login.c
+++ b/usr/src/usr.bin/login/login.c
@@ -1,18 +1,8 @@
-/*
+/*-
  * Copyright (c) 1980, 1987, 1988 The Regents of the University of California.
  * All rights reserved.
  *
  * Copyright (c) 1980, 1987, 1988 The Regents of the University of California.
  * All rights reserved.
  *
- * Redistribution and use in source and binary forms are permitted
- * provided that the above copyright notice and this paragraph are
- * duplicated in all such forms and that any documentation,
- * advertising materials, and other materials related to such
- * distribution and use acknowledge that the software was developed
- * by the University of California, Berkeley.  The name of the
- * University may not be used to endorse or promote products derived
- * from this software without specific prior written permission.
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
- * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+ * %sccs.include.redist.c%
  */
 
 #ifndef lint
  */
 
 #ifndef lint
@@ -22,7 +12,7 @@ char copyright[] =
 #endif /* not lint */
 
 #ifndef lint
 #endif /* not lint */
 
 #ifndef lint
-static char sccsid[] = "@(#)login.c    5.43 (Berkeley) %G%";
+static char sccsid[] = "@(#)login.c    5.61 (Berkeley) %G%";
 #endif /* not lint */
 
 /*
 #endif /* not lint */
 
 /*
@@ -33,12 +23,11 @@ static char sccsid[] = "@(#)login.c 5.43 (Berkeley) %G%";
  */
 
 #include <sys/param.h>
  */
 
 #include <sys/param.h>
-#include <ufs/quota.h>
 #include <sys/stat.h>
 #include <sys/time.h>
 #include <sys/resource.h>
 #include <sys/file.h>
 #include <sys/stat.h>
 #include <sys/time.h>
 #include <sys/resource.h>
 #include <sys/file.h>
-#include <sys/ioctl.h>
+#include <sgtty.h>
 
 #include <utmp.h>
 #include <signal.h>
 
 #include <utmp.h>
 #include <signal.h>
@@ -49,7 +38,7 @@ static char sccsid[] = "@(#)login.c   5.43 (Berkeley) %G%";
 #include <pwd.h>
 #include <setjmp.h>
 #include <stdio.h>
 #include <pwd.h>
 #include <setjmp.h>
 #include <stdio.h>
-#include <strings.h>
+#include <string.h>
 #include <tzfile.h>
 #include "pathnames.h"
 
 #include <tzfile.h>
 #include "pathnames.h"
 
@@ -60,23 +49,22 @@ static char sccsid[] = "@(#)login.c 5.43 (Berkeley) %G%";
  * be patched on machines where it's too small.
  */
 int    timeout = 300;
  * be patched on machines where it's too small.
  */
 int    timeout = 300;
+#ifdef KERBEROS
+int    notickets = 1;
+#endif
 
 struct passwd *pwd;
 int    failures;
 
 struct passwd *pwd;
 int    failures;
-char   term[64], *hostname, *username, *tty;
+char   term[64], *envinit[1], *hostname, *username, *tty;
 
 struct sgttyb sgttyb;
 struct tchars tc = {
        CINTR, CQUIT, CSTART, CSTOP, CEOT, CBRK
 };
 struct ltchars ltc = {
 
 struct sgttyb sgttyb;
 struct tchars tc = {
        CINTR, CQUIT, CSTART, CSTOP, CEOT, CBRK
 };
 struct ltchars ltc = {
-       CSUSP, CDSUSP, CRPRNT, CFLUSH, CWERASE, CLNEXT
+       CSUSP, CDSUSP, CRPRNT, CDISCARD, CWERASE, CLNEXT
 };
 
 };
 
-char *months[] =
-       { "Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug",
-         "Sep", "Oct", "Nov", "Dec" };
-
 char *months[] =
        { "Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug",
          "Sep", "Oct", "Nov", "Dec" };
 char *months[] =
        { "Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug",
          "Sep", "Oct", "Nov", "Dec" };
@@ -85,30 +73,31 @@ main(argc, argv)
        int argc;
        char **argv;
 {
        int argc;
        char **argv;
 {
-       extern int errno, optind;
+       extern int optind;
        extern char *optarg, **environ;
        struct timeval tp;
        struct tm *ttp;
        struct timeval tp;
        extern char *optarg, **environ;
        struct timeval tp;
        struct tm *ttp;
        struct timeval tp;
-       struct tm *ttp;
        struct group *gr;
        register int ch;
        register char *p;
        int ask, fflag, hflag, pflag, rflag, cnt;
        struct group *gr;
        register int ch;
        register char *p;
        int ask, fflag, hflag, pflag, rflag, cnt;
-       int quietlog, passwd_req, ioctlval, timedout();
-       char *domain, *salt, *envinit[1], *ttyn, *pp;
+       int quietlog, ioctlval, rval;
+       char *domain, *salt, *ttyn;
        char tbuf[MAXPATHLEN + 2], tname[sizeof(_PATH_TTY) + 10];
        char localhost[MAXHOSTNAMELEN];
        char *ctime(), *ttyname(), *stypeof(), *crypt(), *getpass();
        time_t time();
        off_t lseek();
        char tbuf[MAXPATHLEN + 2], tname[sizeof(_PATH_TTY) + 10];
        char localhost[MAXHOSTNAMELEN];
        char *ctime(), *ttyname(), *stypeof(), *crypt(), *getpass();
        time_t time();
        off_t lseek();
+       void timedout();
 
        (void)signal(SIGALRM, timedout);
        (void)alarm((u_int)timeout);
        (void)signal(SIGQUIT, SIG_IGN);
        (void)signal(SIGINT, SIG_IGN);
        (void)setpriority(PRIO_PROCESS, 0, 0);
 
        (void)signal(SIGALRM, timedout);
        (void)alarm((u_int)timeout);
        (void)signal(SIGQUIT, SIG_IGN);
        (void)signal(SIGINT, SIG_IGN);
        (void)setpriority(PRIO_PROCESS, 0, 0);
-       (void)quota(Q_SETUID, 0, 0, 0);
+
+       openlog("login", LOG_ODELAY, LOG_AUTH);
 
        /*
         * -p is used by getty to tell login not to destroy the environment
 
        /*
         * -p is used by getty to tell login not to destroy the environment
@@ -124,7 +113,7 @@ main(argc, argv)
                domain = index(localhost, '.');
 
        fflag = hflag = pflag = rflag = 0;
                domain = index(localhost, '.');
 
        fflag = hflag = pflag = rflag = 0;
-       passwd_req = 1;
+       uid = getuid();
        while ((ch = getopt(argc, argv, "fh:pr:")) != EOF)
                switch (ch) {
                case 'f':
        while ((ch = getopt(argc, argv, "fh:pr:")) != EOF)
                switch (ch) {
                case 'f':
@@ -136,7 +125,7 @@ main(argc, argv)
                        fflag = 1;
                        break;
                case 'h':
                        fflag = 1;
                        break;
                case 'h':
-                       if (getuid()) {
+                       if (uid) {
                                (void)fprintf(stderr,
                                    "login: -h for super-user only.\n");
                                exit(1);
                                (void)fprintf(stderr,
                                    "login: -h for super-user only.\n");
                                exit(1);
@@ -180,6 +169,8 @@ main(argc, argv)
                        break;
                case '?':
                default:
                        break;
                case '?':
                default:
+                       if (!uid)
+                               syslog(LOG_ERR, "invalid flag %c", ch);
                        (void)fprintf(stderr,
                            "usage: login [-fp] [username]\n");
                        exit(1);
                        (void)fprintf(stderr,
                            "usage: login [-fp] [username]\n");
                        exit(1);
@@ -188,6 +179,8 @@ main(argc, argv)
        argv += optind;
        if (*argv) {
                username = *argv;
        argv += optind;
        if (*argv) {
                username = *argv;
+               if (strlen(username) > UT_NAMESIZE)
+                       username[UT_NAMESIZE] = '\0';
                ask = 0;
        } else
                ask = 1;
                ask = 0;
        } else
                ask = 1;
@@ -225,8 +218,6 @@ main(argc, argv)
        else
                tty = ttyn;
 
        else
                tty = ttyn;
 
-       openlog("login", LOG_ODELAY, LOG_AUTH);
-
        for (cnt = 0;; ask = 1) {
                ioctlval = TTYDISC;
                (void)ioctl(0, TIOCSETD, &ioctlval);
        for (cnt = 0;; ask = 1) {
                ioctlval = TTYDISC;
                (void)ioctl(0, TIOCSETD, &ioctlval);
@@ -236,9 +227,8 @@ main(argc, argv)
                        getloginname();
                }
                /*
                        getloginname();
                }
                /*
-                * Note if trying multiple user names;
-                * log failures for previous user name,
-                * but don't bother logging one failure
+                * Note if trying multiple user names; log failures for
+                * previous user name, but don't bother logging one failure
                 * for nonexistent name (mistyped username).
                 */
                if (failures && strcmp(tbuf, username)) {
                 * for nonexistent name (mistyped username).
                 */
                if (failures && strcmp(tbuf, username)) {
@@ -247,40 +237,52 @@ main(argc, argv)
                        failures = 0;
                }
                (void)strcpy(tbuf, username);
                        failures = 0;
                }
                (void)strcpy(tbuf, username);
+
                if (pwd = getpwnam(username))
                        salt = pwd->pw_passwd;
                else
                        salt = "xx";
 
                if (pwd = getpwnam(username))
                        salt = pwd->pw_passwd;
                else
                        salt = "xx";
 
-               /* if user not super-user, check for disabled logins */
-               if (pwd == NULL || pwd->pw_uid)
-                       checknologin();
-
                /*
                /*
-                * Disallow automatic login to root; if not invoked by
-                * root, disallow if the uid's differ.
+                * if we have a valid account name, and it doesn't have a
+                * password, or the -f option was specified and the caller
+                * is root or the caller isn't changing their uid, don't
+                * authenticate.
                 */
                 */
-               if (fflag && pwd) {
-                       int uid = getuid();
-
-                       passwd_req = pwd->pw_uid == 0 ||
-                           (uid && uid != pwd->pw_uid);
-               }
+               if (pwd && (*pwd->pw_passwd == '\0' ||
+                   fflag && (uid == 0 || uid == pwd->pw_uid)))
+                       break;
+               fflag = 0;
 
                /*
 
                /*
-                * If no pre-authentication and a password exists
-                * for this user, prompt for one and verify it.
+                * If trying to log in as root, but with insecure terminal,
+                * refuse the login attempt.
                 */
                 */
-               if (!passwd_req || (pwd && !*pwd->pw_passwd))
-                       break;
+               if (pwd && pwd->pw_uid == 0 && !rootterm(tty)) {
+                       (void)fprintf(stderr,
+                           "%s login refused on this terminal.\n",
+                           pwd->pw_name);
+                       if (hostname)
+                               syslog(LOG_NOTICE,
+                                   "LOGIN %s REFUSED FROM %s ON TTY %s",
+                                   pwd->pw_name, hostname, tty);
+                       else
+                               syslog(LOG_NOTICE,
+                                   "LOGIN %s REFUSED ON TTY %s",
+                                    pwd->pw_name, tty);
+                       continue;
+               }
+
+               (void)setpriority(PRIO_PROCESS, 0, -4);
 
 
-               setpriority(PRIO_PROCESS, 0, -4);
-               pp = getpass("Password:");
-               p = crypt(pp, salt);
-               setpriority(PRIO_PROCESS, 0, 0);
+               p = getpass("Password:");
 
 
-               (void) bzero(pp, strlen(pp));
-               if (pwd && !strcmp(p, pwd->pw_passwd))
+               if (pwd) {
+               bzero(p, strlen(p));
+
+               (void)setpriority(PRIO_PROCESS, 0, 0);
+
+               if (pwd && !rval)
                        break;
 
                (void)printf("Login incorrect\n");
                        break;
 
                (void)printf("Login incorrect\n");
@@ -302,35 +304,9 @@ main(argc, argv)
        /* paranoia... */
        endpwent();
 
        /* paranoia... */
        endpwent();
 
-       /*
-        * If valid so far and root is logging in, see if root logins on
-        * this terminal are permitted.
-        */
-       if (pwd->pw_uid == 0 && !rootterm(tty)) {
-               if (hostname)
-                       syslog(LOG_NOTICE, "ROOT LOGIN REFUSED FROM %s",
-                           hostname);
-               else
-                       syslog(LOG_NOTICE, "ROOT LOGIN REFUSED ON %s", tty);
-               (void)printf("Login incorrect\n");
-               sleepexit(1);
-       }
-
-       if (quota(Q_SETUID, pwd->pw_uid, 0, 0) < 0 && errno != EINVAL) {
-               switch(errno) {
-               case EUSERS:
-                       (void)fprintf(stderr,
-               "Too many users logged on already.\nTry again later.\n");
-                       break;
-               case EPROCLIM:
-                       (void)fprintf(stderr,
-                           "You have too many processes running.\n");
-                       break;
-               default:
-                       perror("quota (Q_SETUID)");
-               }
-               sleepexit(0);
-       }
+       /* if user not super-user, check for disabled logins */
+       if (pwd->pw_uid)
+               checknologin();
 
        if (chdir(pwd->pw_dir) < 0) {
                (void)printf("No directory %s!\n", pwd->pw_dir);
 
        if (chdir(pwd->pw_dir) < 0) {
                (void)printf("No directory %s!\n", pwd->pw_dir);
@@ -339,7 +315,6 @@ main(argc, argv)
                pwd->pw_dir = "/";
                (void)printf("Logging in with home = \"/\".\n");
        }
                pwd->pw_dir = "/";
                (void)printf("Logging in with home = \"/\".\n");
        }
-
 #define        TWOWEEKS        (14*24*60*60)
        if (pwd->pw_change || pwd->pw_expire)
                (void)gettimeofday(&tp, (struct timezone *)NULL);
 #define        TWOWEEKS        (14*24*60*60)
        if (pwd->pw_change || pwd->pw_expire)
                (void)gettimeofday(&tp, (struct timezone *)NULL);
@@ -372,30 +347,24 @@ main(argc, argv)
                        sleepexit(1);
                }
                else if (pwd->pw_change - tp.tv_sec <
                        sleepexit(1);
                }
                else if (pwd->pw_change - tp.tv_sec <
-                   2 * DAYSPERWEEK * SECSPERDAY && !quietlog) {
-                       ttp = localtime(&pwd->pw_change);
-                       (void)printf("Warning: your password expires on %s %d, %d\n",
-                           months[ttp->tm_mon], ttp->tm_mday,
-                           TM_YEAR_BASE + ttp->tm_year);
-               }
+                   2 * DAYSPERWEEK * SECSPERDAY && !quietlog)
+                       (void)printf("Warning: your password expires on %s",
+                           ctime(&pwd->pw_expire));
        if (pwd->pw_expire)
                if (tp.tv_sec >= pwd->pw_expire) {
                        (void)printf("Sorry -- your account has expired.\n");
                        sleepexit(1);
                }
                else if (pwd->pw_expire - tp.tv_sec <
        if (pwd->pw_expire)
                if (tp.tv_sec >= pwd->pw_expire) {
                        (void)printf("Sorry -- your account has expired.\n");
                        sleepexit(1);
                }
                else if (pwd->pw_expire - tp.tv_sec <
-                   2 * DAYSPERWEEK * SECSPERDAY && !quietlog) {
-                       ttp = localtime(&pwd->pw_expire);
-                       (void)printf("Warning: your account expires on %s %d, %d\n",
-                           months[ttp->tm_mon], ttp->tm_mday,
-                           TM_YEAR_BASE + ttp->tm_year);
-               }
+                   2 * DAYSPERWEEK * SECSPERDAY && !quietlog)
+                       (void)printf("Warning: your account expires on %s",
+                           ctime(&pwd->pw_expire));
 
        /* nothing else left to fail -- really log in */
        {
                struct utmp utmp;
 
 
        /* nothing else left to fail -- really log in */
        {
                struct utmp utmp;
 
-               bzero((char *)&utmp, sizeof(utmp));
+               bzero((void *)&utmp, sizeof(utmp));
                (void)time(&utmp.ut_time);
                strncpy(utmp.ut_name, username, sizeof(utmp.ut_name));
                if (hostname)
                (void)time(&utmp.ut_time);
                strncpy(utmp.ut_name, username, sizeof(utmp.ut_name));
                if (hostname)
@@ -419,8 +388,6 @@ main(argc, argv)
 
        initgroups(username, pwd->pw_gid);
 
 
        initgroups(username, pwd->pw_gid);
 
-       quota(Q_DOWARN, pwd->pw_uid, (dev_t)-1, 0);
-
        if (*pwd->pw_shell == '\0')
                pwd->pw_shell = _PATH_BSHELL;
 
        if (*pwd->pw_shell == '\0')
                pwd->pw_shell = _PATH_BSHELL;
 
@@ -437,13 +404,19 @@ main(argc, argv)
 
        if (tty[sizeof("tty")-1] == 'd')
                syslog(LOG_INFO, "DIALUP %s, %s", tty, pwd->pw_name);
 
        if (tty[sizeof("tty")-1] == 'd')
                syslog(LOG_INFO, "DIALUP %s, %s", tty, pwd->pw_name);
-       if (pwd->pw_uid == 0)
+       /* if fflag is on, assume caller/authenticator has logged root login */
+       if (pwd->pw_uid == 0 && fflag == 0)
                if (hostname)
                        syslog(LOG_NOTICE, "ROOT LOGIN ON %s FROM %s",
                            tty, hostname);
                else
                        syslog(LOG_NOTICE, "ROOT LOGIN ON %s", tty);
 
                if (hostname)
                        syslog(LOG_NOTICE, "ROOT LOGIN ON %s FROM %s",
                            tty, hostname);
                else
                        syslog(LOG_NOTICE, "ROOT LOGIN ON %s", tty);
 
+#ifdef KERBEROS
+       if (!quietlog && notickets == 1)
+               (void)printf("Warning: no Kerberos tickets issued.\n");
+#endif
+
        if (!quietlog) {
                struct stat st;
 
        if (!quietlog) {
                struct stat st;
 
@@ -463,8 +436,8 @@ main(argc, argv)
        strcpy(tbuf + 1, (p = rindex(pwd->pw_shell, '/')) ?
            p + 1 : pwd->pw_shell);
 
        strcpy(tbuf + 1, (p = rindex(pwd->pw_shell, '/')) ?
            p + 1 : pwd->pw_shell);
 
-       if (setlogname(pwd->pw_name, strlen(pwd->pw_name)) < 0)
-               syslog(LOG_ERR, "setlogname() failure: %m");
+       if (setlogin(pwd->pw_name) < 0)
+               syslog(LOG_ERR, "setlogin() failure: %m");
 
        /* discard permissions last so can't get killed and drop core */
        (void)setuid(pwd->pw_uid);
 
        /* discard permissions last so can't get killed and drop core */
        (void)setuid(pwd->pw_uid);
@@ -502,6 +475,7 @@ getloginname()
        }
 }
 
        }
 }
 
+void
 timedout()
 {
        (void)fprintf(stderr, "Login timed out after %d seconds\n", timeout);
 timedout()
 {
        (void)fprintf(stderr, "Login timed out after %d seconds\n", timeout);
@@ -521,7 +495,8 @@ jmp_buf motdinterrupt;
 motd()
 {
        register int fd, nchars;
 motd()
 {
        register int fd, nchars;
-       int (*oldint)(), sigint();
+       sig_t oldint;
+       int sigint();
        char tbuf[8192];
 
        if ((fd = open(_PATH_MOTDFILE, O_RDONLY, 0)) < 0)
        char tbuf[8192];
 
        if ((fd = open(_PATH_MOTDFILE, O_RDONLY, 0)) < 0)
@@ -575,7 +550,7 @@ dolastlog(quiet)
                        }
                        (void)lseek(fd, (off_t)pwd->pw_uid * sizeof(ll), L_SET);
                }
                        }
                        (void)lseek(fd, (off_t)pwd->pw_uid * sizeof(ll), L_SET);
                }
-               bzero((char *)&ll, sizeof(ll));
+               bzero((void *)&ll, sizeof(ll));
                (void)time(&ll.ll_time);
                strncpy(ll.ll_line, tty, sizeof(ll.ll_line));
                if (hostname)
                (void)time(&ll.ll_time);
                strncpy(ll.ll_line, tty, sizeof(ll.ll_line));
                if (hostname)
@@ -610,23 +585,6 @@ stypeof(ttyid)
        return(ttyid && (t = getttynam(ttyid)) ? t->ty_type : UNKNOWN);
 }
 
        return(ttyid && (t = getttynam(ttyid)) ? t->ty_type : UNKNOWN);
 }
 
-getstr(buf, cnt, err)
-       char *buf, *err;
-       int cnt;
-{
-       char ch;
-
-       do {
-               if (read(0, &ch, sizeof(ch)) != sizeof(ch))
-                       exit(1);
-               if (--cnt < 0) {
-                       (void)fprintf(stderr, "%s too long\r\n", err);
-                       sleepexit(1);
-               }
-               *buf++ = ch;
-       } while (ch);
-}
-
 sleepexit(eval)
        int eval;
 {
 sleepexit(eval)
        int eval;
 {
Continuous source code history from original PDP-7 UNIX to FreeBSD 2, the first fully unencumbered FreeBSD release.