/* $Id$ */
/* Read a password, encrypt it and compare to the encrypted
* password in the TELNETD_PASSWD environment variable.
* No password is required if TELNETD_PASSWD is unset
*/
/*
* Authorship
* ----------
* This software was created by
* Till Straumann <strauman@slac.stanford.edu>, 2003-2007
* Stanford Linear Accelerator Center, Stanford University.
*
* Acknowledgement of sponsorship
* ------------------------------
* This software was produced by
* the Stanford Linear Accelerator Center, Stanford University,
* under Contract DE-AC03-76SFO0515 with the Department of Energy.
*
* Government disclaimer of liability
* ----------------------------------
* Neither the United States nor the United States Department of Energy,
* nor any of their employees, makes any warranty, express or implied, or
* assumes any legal liability or responsibility for the accuracy,
* completeness, or usefulness of any data, apparatus, product, or process
* disclosed, or represents that its use would not infringe privately owned
* rights.
*
* Stanford disclaimer of liability
* --------------------------------
* Stanford University makes no representations or warranties, express or
* implied, nor assumes any liability for the use of this software.
*
* Stanford disclaimer of copyright
* --------------------------------
* Stanford University, owner of the copyright, hereby disclaims its
* copyright and all other rights in this software. Hence, anyone may
* freely use it for any purpose without restriction.
*
* Maintenance of notices
* ----------------------
* In the interest of clarity regarding the origin and status of this
* SLAC software, this and all the preceding Stanford University notices
* are to remain affixed to any copy or derivative of this software made
* or distributed by the recipient and are to be affixed to any copy of
* software made or distributed by the recipient that contains a copy or
* derivative of this software.
*
* ------------------ SLAC Software Notices, Set 4 OTT.002a, 2004 FEB 03
*/
#if !defined(INSIDE_TELNETD) && !defined(__rtems__)
#include <crypt.h>
#endif
#include <termios.h>
#include <errno.h>
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <syslog.h>
#include "passwd.h"
/* rtems has global filedescriptors but per-thread stdio streams... */
#define STDI_FD fileno(stdin)
#define MAXPASSRETRY 3
extern char *__des_crypt_r(char *, char*, char*, int);
#if !defined(INSIDE_TELNETD)
#define sockpeername(s,b,sz) (-1)
#endif
#if defined(INSIDE_TELNETD)
static
#endif
int check_passwd(char *peername)
{
char *pw;
int rval = -1, tmp, retries;
struct termios t,told;
int restore_flags = 0;
char buf[30], cryptbuf[21];
char salt[3];
if ( !(pw=getenv("TELNETD_PASSWD")) || 0 == strlen(pw) )
#ifdef TELNETD_DEFAULT_PASSWD
pw = TELNETD_DEFAULT_PASSWD;
#else
return 0;
#endif
if ( tcgetattr(STDI_FD, &t) ) {
perror("check_passwd(): tcgetattr");
goto done;
}
told = t;
t.c_lflag &= ~ECHO;
t.c_lflag &= ~ICANON;
t.c_cc[VTIME] = 255;
t.c_cc[VMIN] = 0;
strncpy(salt,pw,2);
salt[2]=0;
if ( tcsetattr(STDI_FD, TCSANOW, &t) ) {
perror("check_passwd(): tcsetattr");
goto done;
}
restore_flags = 1;
/* Here we ask for the password... */
for ( retries = MAXPASSRETRY; retries > 0; retries-- ) {
fflush(stdin);
fprintf(stderr,"Password:");
fflush(stderr);
if ( 0 == fgets(buf,sizeof(buf),stdin) ) {
/* Here comes an ugly hack:
* The termios driver's 'read()' handler
* returns 0 to the c library's fgets if
* it times out. 'fgets' interprets this
* (correctly) as EOF, a condition we want
* to undo since it's not really true since
* we really have a read error (termios bug??)
*
* As a workaround we push something back and
* read it again. This should simply reset the
* EOF condition.
*/
if (ungetc('?',stdin) >= 0)
fgetc(stdin);
goto done;
}
fputc('\n',stderr);
tmp = strlen(buf);
while ( tmp > 0 && ('\n' == buf[tmp-1] || '\r' == buf[tmp-1]) ) {
buf[--tmp]=0;
}
if ( !strcmp(__des_crypt_r(buf, salt, cryptbuf, sizeof(cryptbuf)), pw) ) {
rval = 0;
break;
}
fprintf(stderr,"Incorrect Password.\n");
sleep(2);
}
if ( 0 == retries ) {
syslog( LOG_AUTHPRIV | LOG_WARNING,
"telnetd: %i wrong passwords entered from %s",
MAXPASSRETRY,
peername ? peername : "<UNKNOWN>");
}
done:
/* what to do if restoring the flags fails?? */
if (restore_flags)
tcsetattr(STDI_FD, TCSANOW, &told);
if (rval) {
sleep(2);
}
return rval;
}
#if !defined(INSIDE_TELNETD) && !defined(__rtems__)
int
main(int argc, char **argv)
{
char *str, *enc=0;
int ch;
while ( (ch=getopt(argc, argv, "g:")) > 0 ) {
switch (ch) {
default:
fprintf(stderr,"Unknown option\n");
return(1);
case 'g':
printf("Generated encrypted password: '%s'\n", (enc=crypt(optarg,"td")));
break;
}
}
if (argc>optind && !enc) {
enc=argv[optind];
}
if (enc) {
str = malloc(strlen(enc) + 30);
sprintf(str,"TELNETD_PASSWD=%s",enc);
putenv(str);
}
if (check_passwd(-1)) {
fprintf(stderr,"check_passwd() failed\n");
}
return 0;
}
#endif
