1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
|
/* Copyright (c) 2002-2018 Dovecot authors, see the included COPYING file */
#include "auth-common.h"
#include "passdb.h"
#ifdef PASSDB_SHADOW
#include "safe-memset.h"
#include <shadow.h>
#define SHADOW_CACHE_KEY "%u"
#define SHADOW_PASS_SCHEME "CRYPT"
static enum passdb_result
shadow_lookup(struct auth_request *request, struct spwd **spw_r)
{
e_debug(authdb_event(request), "lookup");
*spw_r = getspnam(request->fields.user);
if (*spw_r == NULL) {
auth_request_log_unknown_user(request, AUTH_SUBSYS_DB);
return PASSDB_RESULT_USER_UNKNOWN;
}
if (!IS_VALID_PASSWD((*spw_r)->sp_pwdp)) {
e_info(authdb_event(request),
"invalid password field");
return PASSDB_RESULT_USER_DISABLED;
}
/* save the password so cache can use it */
auth_request_set_field(request, "password", (*spw_r)->sp_pwdp,
SHADOW_PASS_SCHEME);
return PASSDB_RESULT_OK;
}
static void
shadow_verify_plain(struct auth_request *request, const char *password,
verify_plain_callback_t *callback)
{
struct spwd *spw;
enum passdb_result res;
int ret;
res = shadow_lookup(request, &spw);
if (res != PASSDB_RESULT_OK) {
callback(res, request);
return;
}
/* check if the password is valid */
ret = auth_request_password_verify(request, password, spw->sp_pwdp,
SHADOW_PASS_SCHEME, AUTH_SUBSYS_DB);
/* clear the passwords from memory */
safe_memset(spw->sp_pwdp, 0, strlen(spw->sp_pwdp));
if (ret <= 0) {
callback(PASSDB_RESULT_PASSWORD_MISMATCH, request);
return;
}
/* make sure we're using the username exactly as it's in the database */
auth_request_set_field(request, "user", spw->sp_namp, NULL);
callback(PASSDB_RESULT_OK, request);
}
static void
shadow_lookup_credentials(struct auth_request *request,
lookup_credentials_callback_t *callback)
{
struct spwd *spw;
enum passdb_result res;
res = shadow_lookup(request, &spw);
if (res != PASSDB_RESULT_OK) {
callback(res, NULL, 0, request);
return;
}
/* make sure we're using the username exactly as it's in the database */
auth_request_set_field(request, "user", spw->sp_namp, NULL);
passdb_handle_credentials(PASSDB_RESULT_OK, spw->sp_pwdp,
SHADOW_PASS_SCHEME, callback, request);
}
static struct passdb_module *
shadow_preinit(pool_t pool, const char *args)
{
struct passdb_module *module;
module = p_new(pool, struct passdb_module, 1);
module->blocking = TRUE;
if (strcmp(args, "blocking=no") == 0)
module->blocking = FALSE;
else if (*args != '\0')
i_fatal("passdb shadow: Unknown setting: %s", args);
module->default_cache_key = SHADOW_CACHE_KEY;
module->default_pass_scheme = SHADOW_PASS_SCHEME;
return module;
}
static void shadow_deinit(struct passdb_module *module ATTR_UNUSED)
{
endspent();
}
struct passdb_module_interface passdb_shadow = {
"shadow",
shadow_preinit,
NULL,
shadow_deinit,
shadow_verify_plain,
shadow_lookup_credentials,
NULL
};
#else
struct passdb_module_interface passdb_shadow = {
.name = "shadow"
};
#endif
|
