change so that user entered info gets put in secure logfile

[unix-history] / usr / src / usr.bin / login / login.c

diff --git a/usr/src/usr.bin/login/login.c b/usr/src/usr.bin/login/login.c
index c6f3343..002d6ba 100644 (file)
--- a/usr/src/usr.bin/login/login.c
+++ b/usr/src/usr.bin/login/login.c
@@ -12,7 +12,7 @@ char copyright[] =
 #endif /* not lint */
 
 #ifndef lint
 #endif /* not lint */
 
 #ifndef lint

-static char sccsid[] = "@(#)login.c    5.56 (Berkeley) %G%";
+static char sccsid[] = "@(#)login.c    5.64 (Berkeley) %G%";

 #endif /* not lint */
 
 /*
 #endif /* not lint */
 
 /*


@@ -57,18 +57,6 @@ struct       passwd *pwd;
 int    failures;
 char   term[64], *envinit[1], *hostname, *username, *tty;
 
 int    failures;
 char   term[64], *envinit[1], *hostname, *username, *tty;
 

-struct sgttyb sgttyb;
-struct tchars tc = {
-       CINTR, CQUIT, CSTART, CSTOP, CEOT, CBRK
-};
-struct ltchars ltc = {
-       CSUSP, CDSUSP, CRPRNT, CDISCARD, CWERASE, CLNEXT
-};
-
-char *months[] =
-       { "Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug",
-         "Sep", "Oct", "Nov", "Dec" };
-

 char *months[] =
        { "Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug",
          "Sep", "Oct", "Nov", "Dec" };
 char *months[] =
        { "Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug",
          "Sep", "Oct", "Nov", "Dec" };


@@ -82,12 +70,11 @@ main(argc, argv)
        struct timeval tp;
        struct tm *ttp;
        struct timeval tp;
        struct timeval tp;
        struct tm *ttp;
        struct timeval tp;

-       struct tm *ttp;

        struct group *gr;
        register int ch;
        register char *p;
        int ask, fflag, hflag, pflag, rflag, cnt;
        struct group *gr;
        register int ch;
        register char *p;
        int ask, fflag, hflag, pflag, rflag, cnt;

-       int quietlog, passwd_req, ioctlval, rval;
+       int quietlog, rval;

        char *domain, *salt, *ttyn;
        char tbuf[MAXPATHLEN + 2], tname[sizeof(_PATH_TTY) + 10];
        char localhost[MAXHOSTNAMELEN];
        char *domain, *salt, *ttyn;
        char tbuf[MAXPATHLEN + 2], tname[sizeof(_PATH_TTY) + 10];
        char localhost[MAXHOSTNAMELEN];


@@ -118,7 +105,6 @@ main(argc, argv)
                domain = index(localhost, '.');
 
        fflag = hflag = pflag = rflag = 0;
                domain = index(localhost, '.');
 
        fflag = hflag = pflag = rflag = 0;

-       passwd_req = 1;

        uid = getuid();
        while ((ch = getopt(argc, argv, "fh:pr:")) != EOF)
                switch (ch) {
        uid = getuid();
        while ((ch = getopt(argc, argv, "fh:pr:")) != EOF)
                switch (ch) {


@@ -193,24 +179,6 @@ main(argc, argv)
        if (rflag)
                ask = 0;
 
        if (rflag)
                ask = 0;
 

-       ioctlval = 0;
-       (void)ioctl(0, TIOCLSET, &ioctlval);
-       (void)ioctl(0, TIOCNXCL, 0);
-       (void)fcntl(0, F_SETFL, ioctlval);
-       (void)ioctl(0, TIOCGETP, &sgttyb);
-
-       /*
-        * If talking to an rlogin process, propagate the terminal type and
-        * baud rate across the network.
-        */
-       if (rflag)
-               doremoteterm(&sgttyb);
-       sgttyb.sg_erase = CERASE;
-       sgttyb.sg_kill = CKILL;
-       (void)ioctl(0, TIOCSLTC, &ltc);
-       (void)ioctl(0, TIOCSETC, &tc);
-       (void)ioctl(0, TIOCSETP, &sgttyb);
-

        for (cnt = getdtablesize(); cnt > 2; cnt--)
                close(cnt);
 
        for (cnt = getdtablesize(); cnt > 2; cnt--)
                close(cnt);
 


@@ -225,9 +193,6 @@ main(argc, argv)
                tty = ttyn;
 
        for (cnt = 0;; ask = 1) {
                tty = ttyn;
 
        for (cnt = 0;; ask = 1) {

-               ioctlval = TTYDISC;
-               (void)ioctl(0, TIOCSETD, &ioctlval);
-

                if (ask) {
                        fflag = 0;
                        getloginname();
                if (ask) {
                        fflag = 0;
                        getloginname();


@@ -243,42 +208,28 @@ main(argc, argv)
                        failures = 0;
                }
                (void)strcpy(tbuf, username);
                        failures = 0;
                }
                (void)strcpy(tbuf, username);

+

                if (pwd = getpwnam(username))
                        salt = pwd->pw_passwd;
                if (pwd = getpwnam(username))
                        salt = pwd->pw_passwd;

-               else {
-                       /* take up the right amount of time */
-                       (void)crypt(getpass("Password:"), "xx");
-                       goto faked;
-               }
-
-               /* if user not super-user, check for disabled logins */
-               if (pwd->pw_uid)
-                       checknologin();
-
-               /*
-                * Disallow automatic login to root; if not invoked by
-                * root, disallow if the uid's differ.
-                */
-               if (fflag) {
-                       passwd_req =
-#ifndef        KERBEROS
-                            pwd->pw_uid == 0 ||
-#endif
-                           (uid && uid != pwd->pw_uid);
-               }
+               else
+                       salt = "xx";

 
                /*
 
                /*

-                * If no pre-authentication and a password exists
-                * for this user, prompt for one and verify it.
+                * if we have a valid account name, and it doesn't have a
+                * password, or the -f option was specified and the caller
+                * is root or the caller isn't changing their uid, don't
+                * authenticate.

                 */
                 */

-               if (!passwd_req || !*pwd->pw_passwd)
+               if (pwd && (*pwd->pw_passwd == '\0' ||
+                   fflag && (uid == 0 || uid == pwd->pw_uid)))

                        break;
                        break;

+               fflag = 0;

 
                /*
                 * If trying to log in as root, but with insecure terminal,
                 * refuse the login attempt.
                 */
 
                /*
                 * If trying to log in as root, but with insecure terminal,
                 * refuse the login attempt.
                 */

-               if (pwd->pw_uid == 0 && !rootterm(tty)) {
+               if (pwd && pwd->pw_uid == 0 && !rootterm(tty)) {

                        (void)fprintf(stderr,
                            "%s login refused on this terminal.\n",
                            pwd->pw_name);
                        (void)fprintf(stderr,
                            "%s login refused on this terminal.\n",
                            pwd->pw_name);


@@ -294,19 +245,23 @@ main(argc, argv)
                }
 
                (void)setpriority(PRIO_PROCESS, 0, -4);
                }
 
                (void)setpriority(PRIO_PROCESS, 0, -4);

+

                p = getpass("Password:");
 
                p = getpass("Password:");
 

+               if (pwd) {

                bzero(p, strlen(p));
                bzero(p, strlen(p));

-               if (!rval)
+
+               (void)setpriority(PRIO_PROCESS, 0, 0);
+
+               if (pwd && !rval)

                        break;
 
                        break;
 

-faked:         (void)printf("Login incorrect\n");
+               (void)printf("Login incorrect\n");

                failures++;
                /* we allow 10 tries, but after 3 we start backing off */
                if (++cnt > 3) {
                        if (cnt >= 10) {
                                badlogin(username);
                failures++;
                /* we allow 10 tries, but after 3 we start backing off */
                if (++cnt > 3) {
                        if (cnt >= 10) {
                                badlogin(username);

-                               (void)ioctl(0, TIOCHPCL, (struct sgttyb *)NULL);

                                sleepexit(1);
                        }
                        sleep((u_int)((cnt - 3) * 5));
                                sleepexit(1);
                        }
                        sleep((u_int)((cnt - 3) * 5));


@@ -316,12 +271,13 @@ faked:            (void)printf("Login incorrect\n");
        /* committed to login -- turn off timeout */
        (void)alarm((u_int)0);
 
        /* committed to login -- turn off timeout */
        (void)alarm((u_int)0);
 

-       /* reset priority */
-       (void)setpriority(PRIO_PROCESS, 0, 0);
-

        /* paranoia... */
        endpwent();
 
        /* paranoia... */
        endpwent();
 

+       /* if user not super-user, check for disabled logins */
+       if (pwd->pw_uid)
+               checknologin();
+

        if (chdir(pwd->pw_dir) < 0) {
                (void)printf("No directory %s!\n", pwd->pw_dir);
                if (chdir("/"))
        if (chdir(pwd->pw_dir) < 0) {
                (void)printf("No directory %s!\n", pwd->pw_dir);
                if (chdir("/"))


@@ -361,24 +317,18 @@ faked:            (void)printf("Login incorrect\n");
                        sleepexit(1);
                }
                else if (pwd->pw_change - tp.tv_sec <
                        sleepexit(1);
                }
                else if (pwd->pw_change - tp.tv_sec <

-                   2 * DAYSPERWEEK * SECSPERDAY && !quietlog) {
-                       ttp = localtime(&pwd->pw_change);
-                       (void)printf("Warning: your password expires on %s %d, %d\n",
-                           months[ttp->tm_mon], ttp->tm_mday,
-                           TM_YEAR_BASE + ttp->tm_year);
-               }
+                   2 * DAYSPERWEEK * SECSPERDAY && !quietlog)
+                       (void)printf("Warning: your password expires on %s",
+                           ctime(&pwd->pw_expire));

        if (pwd->pw_expire)
                if (tp.tv_sec >= pwd->pw_expire) {
                        (void)printf("Sorry -- your account has expired.\n");
                        sleepexit(1);
                }
                else if (pwd->pw_expire - tp.tv_sec <
        if (pwd->pw_expire)
                if (tp.tv_sec >= pwd->pw_expire) {
                        (void)printf("Sorry -- your account has expired.\n");
                        sleepexit(1);
                }
                else if (pwd->pw_expire - tp.tv_sec <

-                   2 * DAYSPERWEEK * SECSPERDAY && !quietlog) {
-                       ttp = localtime(&pwd->pw_expire);
-                       (void)printf("Warning: your account expires on %s %d, %d\n",
-                           months[ttp->tm_mon], ttp->tm_mday,
-                           TM_YEAR_BASE + ttp->tm_year);
-               }
+                   2 * DAYSPERWEEK * SECSPERDAY && !quietlog)
+                       (void)printf("Warning: your account expires on %s",
+                           ctime(&pwd->pw_expire));

 
        /* nothing else left to fail -- really log in */
        {
 
        /* nothing else left to fail -- really log in */
        {


@@ -395,12 +345,6 @@ faked:             (void)printf("Login incorrect\n");
 
        dolastlog(quietlog);
 
 
        dolastlog(quietlog);
 

-       if (!hflag && !rflag) {                                 /* XXX */
-               static struct winsize win = { 0, 0, 0, 0 };
-
-               (void)ioctl(0, TIOCSWINSZ, &win);
-       }
-

        (void)chown(ttyn, pwd->pw_uid,
            (gr = getgrnam(TTYGRPNAME)) ? gr->gr_gid : pwd->pw_gid);
        (void)chmod(ttyn, 0620);
        (void)chown(ttyn, pwd->pw_uid,
            (gr = getgrnam(TTYGRPNAME)) ? gr->gr_gid : pwd->pw_gid);
        (void)chmod(ttyn, 0620);


@@ -424,7 +368,8 @@ faked:              (void)printf("Login incorrect\n");
 
        if (tty[sizeof("tty")-1] == 'd')
                syslog(LOG_INFO, "DIALUP %s, %s", tty, pwd->pw_name);
 
        if (tty[sizeof("tty")-1] == 'd')
                syslog(LOG_INFO, "DIALUP %s, %s", tty, pwd->pw_name);

-       if (pwd->pw_uid == 0)
+       /* if fflag is on, assume caller/authenticator has logged root login */
+       if (pwd->pw_uid == 0 && fflag == 0)

                if (hostname)
                        syslog(LOG_NOTICE, "ROOT LOGIN ON %s FROM %s",
                            tty, hostname);
                if (hostname)
                        syslog(LOG_NOTICE, "ROOT LOGIN ON %s FROM %s",
                            tty, hostname);