FreeBSD/crypto/openssh/auth.c
/*
 * Check if the user is allowed to log in via ssh. If user is listed
 * in DenyUsers or one of user's groups is listed in DenyGroups, false
 * will be returned. If AllowUsers isn't empty and user isn't listed
 * there, or if AllowGroups isn't empty and one of user's groups isn't
 * listed there, false will be returned.
 * If the user's shell is not executable, false will be returned.
 * Otherwise true is returned.
 */
Check if the user is allowed to log in via ssh. If user is listed
in DenyUsers or one of user's groups is listed in DenyGroups, false
will be returned.
Check if the user is allowed to log in via ssh . If user is listed in DenyUsers or one of user ' s groups is listed in DenyGroups false will be returned .
int
allowed_user(struct passwd * pw)
{
	struct stat st;
	const char *hostname = NULL, *ipaddr = NULL, *passwd = NULL;
	u_int i;
#ifdef USE_SHADOW
	struct spwd *spw = NULL;
#endif
	if (!pw || !pw->pw_name)
		return 0;
#ifdef USE_SHADOW
	if (!options.use_pam)
		spw = getspnam(pw->pw_name);
#ifdef HAS_SHADOW_EXPIRE
	if (!options.use_pam && spw != NULL && auth_shadow_acctexpired(spw))
		return 0;
#endif 
#endif 
	passwd = pw->pw_passwd;
#ifdef USE_SHADOW
	if (spw != NULL)
#ifdef USE_LIBIAF
		passwd = get_iaf_password(pw);
#else
		passwd = spw->sp_pwdp;
#endif 
#endif
	if (!options.use_pam && passwd && *passwd) {
		int locked = 0;
#ifdef LOCKED_PASSWD_STRING
		if (strcmp(passwd, LOCKED_PASSWD_STRING) == 0)
			 locked = 1;
#endif
#ifdef LOCKED_PASSWD_PREFIX
		if (strncmp(passwd, LOCKED_PASSWD_PREFIX,
		    strlen(LOCKED_PASSWD_PREFIX)) == 0)
			 locked = 1;
#endif
#ifdef LOCKED_PASSWD_SUBSTR
		if (strstr(passwd, LOCKED_PASSWD_SUBSTR))
			locked = 1;
#endif
#ifdef USE_LIBIAF
		free((void *) passwd);
#endif 
		if (locked) {
			logit("User %.100s not allowed because account is locked",
			    pw->pw_name);
			return 0;
		}
	}
	if (options.chroot_directory == NULL ||
	    strcasecmp(options.chroot_directory, "none") == 0) {
		char *shell = xstrdup((pw->pw_shell[0] == '\0') ?
		    _PATH_BSHELL : pw->pw_shell); 
		if (stat(shell, &st) != 0) {
			logit("User %.100s not allowed because shell %.100s "
			    "does not exist", pw->pw_name, shell);
			free(shell);
			return 0;
		}
		if (S_ISREG(st.st_mode) == 0 ||
		    (st.st_mode & (S_IXOTH|S_IXUSR|S_IXGRP)) == 0) {
			logit("User %.100s not allowed because shell %.100s "
			    "is not executable", pw->pw_name, shell);
			free(shell);
			return 0;
		}
		free(shell);
	}
	if (options.num_deny_users > 0 || options.num_allow_users > 0 ||
	    options.num_deny_groups > 0 || options.num_allow_groups > 0) {
		hostname = get_canonical_hostname(options.use_dns);
		ipaddr = get_remote_ipaddr();
	}
	if (options.num_deny_users > 0) {
		for (i = 0; i < options.num_deny_users; i++)
			if (match_user(pw->pw_name, hostname, ipaddr,
			    options.deny_users[i])) {
				logit("User %.100s from %.100s not allowed "
				    "because listed in DenyUsers",
				    pw->pw_name, hostname);
				return 0;
			}
	}
	if (options.num_allow_users > 0) {
		for (i = 0; i < options.num_allow_users; i++)
			if (match_user(pw->pw_name, hostname, ipaddr,
			    options.allow_users[i]))
				break;
		if (i >= options.num_allow_users) {
			logit("User %.100s from %.100s not allowed because "
			    "not listed in AllowUsers", pw->pw_name, hostname);
			return 0;
		}
	}
	if (options.num_deny_groups > 0 || options.num_allow_groups > 0) {
		if (ga_init(pw->pw_name, pw->pw_gid) == 0) {
			logit("User %.100s from %.100s not allowed because "
			    "not in any group", pw->pw_name, hostname);
			return 0;
		}
		if (options.num_deny_groups > 0)
			if (ga_match(options.deny_groups,
			    options.num_deny_groups)) {
				ga_free();
				logit("User %.100s from %.100s not allowed "
				    "because a group is listed in DenyGroups",
				    pw->pw_name, hostname);
				return 0;
			}
		if (options.num_allow_groups > 0)
			if (!ga_match(options.allow_groups,
			    options.num_allow_groups)) {
				ga_free();
				logit("User %.100s from %.100s not allowed "
				    "because none of user's groups are listed "
				    "in AllowGroups", pw->pw_name, hostname);
				return 0;
			}
		ga_free();
	}
#ifdef CUSTOM_SYS_AUTH_ALLOWED_USER
	if (!sys_auth_allowed_user(pw, &loginmsg))
		return 0;
#endif
	return 1;
}
int allowed_user ( struct passwd * pw ) { struct stat st ; const char * hostname = NULL , * ipaddr = NULL , * passwd = NULL ; u_int i ; #ifdef USE_SHADOW struct spwd * spw = NULL ; #endif if ( ! pw || ! pw -> pw_name ) return 0 ; #ifdef USE_SHADOW if ( ! options . use_pam ) spw = getspnam ( pw -> pw_name ) ; #ifdef HAS_SHADOW_EXPIRE if ( ! options . use_pam && spw != NULL && auth_shadow_acctexpired ( spw ) ) return 0 ; #endif #endif passwd = pw -> pw_passwd ; #ifdef USE_SHADOW if ( spw != NULL ) #ifdef USE_LIBIAF passwd = get_iaf_password ( pw ) ; #else passwd = spw -> sp_pwdp ; #endif #endif if ( ! options . use_pam && passwd && * passwd ) { int locked = 0 ; #ifdef LOCKED_PASSWD_STRING if ( strcmp ( passwd , LOCKED_PASSWD_STRING ) == 0 ) locked = 1 ; #endif #ifdef LOCKED_PASSWD_PREFIX if ( strncmp ( passwd , LOCKED_PASSWD_PREFIX , strlen ( LOCKED_PASSWD_PREFIX ) ) == 0 ) locked = 1 ; #endif #ifdef LOCKED_PASSWD_SUBSTR if ( strstr ( passwd , LOCKED_PASSWD_SUBSTR ) ) locked = 1 ; #endif #ifdef USE_LIBIAF free ( ( void * ) passwd ) ; #endif if ( locked ) { logit ( " " , pw -> pw_name ) ; return 0 ; } } if ( options . chroot_directory == NULL || strcasecmp ( options . chroot_directory , " " ) == 0 ) { char * shell = xstrdup ( ( pw -> pw_shell [ 0 ] == ' \0 ' ) ? _PATH_BSHELL : pw -> pw_shell ) ; if ( stat ( shell , & st ) != 0 ) { logit ( " " " " , pw -> pw_name , shell ) ; free ( shell ) ; return 0 ; } if ( S_ISREG ( st . st_mode ) == 0 || ( st . st_mode & ( S_IXOTH | S_IXUSR | S_IXGRP ) ) == 0 ) { logit ( " " " " , pw -> pw_name , shell ) ; free ( shell ) ; return 0 ; } free ( shell ) ; } if ( options . num_deny_users > 0 || options . num_allow_users > 0 || options . num_deny_groups > 0 || options . num_allow_groups > 0 ) { hostname = get_canonical_hostname ( options . use_dns ) ; ipaddr = get_remote_ipaddr ( ) ; } if ( options . num_deny_users > 0 ) { for ( i = 0 ; i < options . num_deny_users ; i ++ ) if ( match_user ( pw -> pw_name , hostname , ipaddr , options . deny_users [ i ] ) ) { logit ( " " " " , pw -> pw_name , hostname ) ; return 0 ; } } if ( options . num_allow_users > 0 ) { for ( i = 0 ; i < options . num_allow_users ; i ++ ) if ( match_user ( pw -> pw_name , hostname , ipaddr , options . allow_users [ i ] ) ) break ; if ( i >= options . num_allow_users ) { logit ( " " " " , pw -> pw_name , hostname ) ; return 0 ; } } if ( options . num_deny_groups > 0 || options . num_allow_groups > 0 ) { if ( ga_init ( pw -> pw_name , pw -> pw_gid ) == 0 ) { logit ( " " " " , pw -> pw_name , hostname ) ; return 0 ; } if ( options . num_deny_groups > 0 ) if ( ga_match ( options . deny_groups , options . num_deny_groups ) ) { ga_free ( ) ; logit ( " " " " , pw -> pw_name , hostname ) ; return 0 ; } if ( options . num_allow_groups > 0 ) if ( ! ga_match ( options . allow_groups , options . num_allow_groups ) ) { ga_free ( ) ; logit ( " " " " " " , pw -> pw_name , hostname ) ; return 0 ; } ga_free ( ) ; } #ifdef CUSTOM_SYS_AUTH_ALLOWED_USER if ( ! sys_auth_allowed_user ( pw , & loginmsg ) ) return 0 ; #endif return 1 ; }
Check if the user is allowed to log in via ssh.
Check if the user is allowed to log in via ssh .
/* Shouldn't be called if pw is NULL, but better safe than sorry... */ /* HAS_SHADOW_EXPIRE */ /* USE_SHADOW */ /* grab passwd field for locked account check */ /* USE_LIBIAF */ /* check for locked account */ /* USE_LIBIAF */ /*
	 * Deny if shell does not exist or is not executable unless we
	 * are chrooting.
	 */ /* empty = /bin/sh */ /* Return false if user is listed in DenyUsers */ /* Return false if AllowUsers isn't empty and user isn't listed there */ /* i < options.num_allow_users iff we break for loop */ /* Get the user's group access list (primary and supplementary) */ /* Return false if one of user's groups is listed in DenyGroups */ /*
		 * Return false if AllowGroups isn't empty and one of user's groups
		 * isn't listed there
		 */ /* We found no reason not to let this user try to log on... */