OpenSolaris_b135/lib/pam_modules/authtok_check/authtok_check.c
/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License (the "License").
* You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* or http://www.opensolaris.org/os/licensing.
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Copyright 2009 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
#include <sys/types.h>
#include <sys/varargs.h>
#include <sys/param.h>
#include <sys/sysmacros.h>
#include <stdio.h>
#include <stdlib.h>
#include <deflt.h>
#include <security/pam_appl.h>
#include <security/pam_modules.h>
#include <security/pam_impl.h>
#include <string.h>
#include <ctype.h>
#include <unistd.h>
#include <syslog.h>
#include <libintl.h>
#include <errno.h>
#include <pwd.h>
#include "packer.h"
#include <passwdutil.h>
#define PWADMIN "/etc/default/passwd"
#define MINLENGTH 6
#define MINDIFF 3
#define MINALPHA 2
#define MINNONALPHA 1
mutex_t dictlock = DEFAULTMUTEX;
/*
* We implement:
* PASSLENGTH (int) minimum password length
* NAMECHECK (yes/no) perform comparison of password and loginname
* MINDIFF (int) minimum number of character-positions in which
* the old and the new password should differ.
* MINALPHA (int) minimum number of Alpha characters
* MINUPPER (int) minimum number of upper-case characters
* MINLOWER (int) minimum number of lower-case characters
* MAXREPEATS (int) maximum number of consecutively repeating chars
* WHITESPACE (yes/no) Are whitespaces allowed?
*
* Furthermore, these two mutualy exclusive groups of options are allowed:
*
* MINNONALPHA (int) minimum number of characters from the
* character classes [ punct, space, digit ]
* if WHITESPACE == NO, whitespaces don't count.
* and
* MINSPECIAL (int) minimum number of punctuation characters.
* if WHITESPACE != NO, whitespace is seen as
* a "special" character.
* MINDIGIT (int) minimum number of digits
*
* specifying options from both groups results in an error to syslog and
* failure to change the password.
*
* NOTE:
* HISTORY is implemented at the repository level (passwdutil).
*/
/*
* default password-strength-values, compiled-in or stored in PWADMIN
* are kept in here
*/
struct pwdefaults {
boolean_t server_policy; /* server policy flag from pam.conf */
uint_t minlength; /* minimum password lenght */
uint_t maxlength; /* maximum (significant) length */
boolean_t do_namecheck; /* check password against user's gecos */
char db_location[MAXPATHLEN]; /* location of the generated database */
boolean_t do_dictcheck; /* perform dictionary lookup */
char *dicts; /* list of dictionaries configured */
uint_t mindiff; /* old and new should differ by this much */
uint_t minalpha; /* minimum alpha characters required */
uint_t minupper; /* minimum uppercase characters required */
uint_t minlower; /* minimum lowercase characters required */
uint_t minnonalpha; /* minimum special (non alpha) required */
uint_t maxrepeat; /* maximum number of repeating chars allowed */
uint_t minspecial; /* punctuation characters */
uint_t mindigit; /* minimum number of digits required */
boolean_t whitespace; /* is whitespace allowed in a password */
};
/*PRINTFLIKE3*/
void
error(pam_handle_t *pamh, int flags, char *fmt, ...)
{
va_list ap;
char msg[1][PAM_MAX_MSG_SIZE];
va_start(ap, fmt);
(void) vsnprintf(msg[0], sizeof (msg[0]), fmt, ap);
va_end(ap);
if ((flags & PAM_SILENT) == 0)
(void) __pam_display_msg(pamh, PAM_ERROR_MSG, 1, msg, NULL);
}
int
defread_int(char *name, uint_t *ip, void *defp)
{
char *q;
int r = 0;
if ((q = defread_r(name, defp)) != NULL) {
if (!isdigit(*q)) {
syslog(LOG_ERR, "pam_authtok_check: %s contains "
"non-integer value for %s: %s. "
"Using default instead.", PWADMIN, name, q);
} else {
*ip = atoi(q);
r = 1;
}
}
return (r);
}
/*
* fill in static defaults, and augment with settings from PWADMIN
* get system defaults with regard to maximum password length
*/
int
get_passwd_defaults(pam_handle_t *pamh, char *user, struct pwdefaults *p)
{
char *q;
boolean_t minnonalpha_defined = B_FALSE;
pwu_repository_t *pwu_rep;
struct pam_repository *pam_rep;
attrlist attr[2];
int result;
char *progname;
void *defp;
(void) pam_get_item(pamh, PAM_SERVICE, (void **)&progname);
/* Module defaults */
p->minlength = MINLENGTH;
p->do_namecheck = B_TRUE;
p->do_dictcheck = B_FALSE;
p->dicts = NULL;
p->mindiff = MINDIFF;
p->minalpha = MINALPHA;
p->minnonalpha = MINNONALPHA;
p->minupper = 0; /* not configured by default */
p->minlower = 0; /* not configured by default */
p->maxrepeat = 0; /* not configured by default */
p->minspecial = 0;
p->mindigit = 0;
p->whitespace = B_TRUE;
if ((defp = defopen_r(PWADMIN)) == NULL)
return (PAM_SUCCESS);
(void) defread_int("PASSLENGTH=", &p->minlength, defp);
if ((q = defread_r("NAMECHECK=", defp)) != NULL &&
strcasecmp(q, "NO") == 0)
p->do_namecheck = B_FALSE;
if ((q = defread_r("DICTIONLIST=", defp)) != NULL) {
if ((p->dicts = strdup(q)) == NULL) {
syslog(LOG_ERR, "pam_authtok_check: out of memory");
defclose_r(defp);
return (PAM_BUF_ERR);
}
p->do_dictcheck = B_TRUE;
} else {
p->dicts = NULL;
}
if ((q = defread_r("DICTIONDBDIR=", defp)) != NULL) {
if (strlcpy(p->db_location, q, sizeof (p->db_location)) >=
sizeof (p->db_location)) {
syslog(LOG_ERR, "pam_authtok_check: value for "
"DICTIONDBDIR too large.");
defclose_r(defp);
return (PAM_SYSTEM_ERR);
}
p->do_dictcheck = B_TRUE;
} else {
(void) strlcpy(p->db_location, CRACK_DIR,
sizeof (p->db_location));
}
(void) defread_int("MINDIFF=", &p->mindiff, defp);
(void) defread_int("MINALPHA=", &p->minalpha, defp);
(void) defread_int("MINUPPER=", &p->minupper, defp);
(void) defread_int("MINLOWER=", &p->minlower, defp);
if (defread_int("MINNONALPHA=", &p->minnonalpha, defp))
minnonalpha_defined = B_TRUE;
(void) defread_int("MAXREPEATS=", &p->maxrepeat, defp);
if (defread_int("MINSPECIAL=", &p->minspecial, defp)) {
if (minnonalpha_defined) {
syslog(LOG_ERR, "pam_authtok_check: %s contains "
"definition for MINNONALPHA and for MINSPECIAL. "
"These options are mutually exclusive.", PWADMIN);
defclose_r(defp);
return (PAM_SYSTEM_ERR);
}
p->minnonalpha = 0;
}
if (defread_int("MINDIGIT=", &p->mindigit, defp)) {
if (minnonalpha_defined) {
syslog(LOG_ERR, "pam_authtok_check: %s contains "
"definition for MINNONALPHA and for MINDIGIT. "
"These options are mutually exclusive.", PWADMIN);
defclose_r(defp);
return (PAM_SYSTEM_ERR);
}
p->minnonalpha = 0;
}
if ((q = defread_r("WHITESPACE=", defp)) != NULL)
p->whitespace =
(strcasecmp(q, "no") == 0 || strcmp(q, "0") == 0)
? B_FALSE : B_TRUE;
defclose_r(defp);
/*
* Determine the number of significant characters in a password
*
* we find out where the user information came from (which repository),
* and which password-crypt-algorithm is to be used (based on the
* old password, or the system default).
*
* If the user comes from a repository other than FILES/NIS
* the module-flag "server_policy" means that we don't perform
* any checks on the user, but let the repository decide instead.
*/
(void) pam_get_item(pamh, PAM_REPOSITORY, (void **)&pam_rep);
if (pam_rep != NULL) {
if ((pwu_rep = calloc(1, sizeof (*pwu_rep))) == NULL)
return (PAM_BUF_ERR);
pwu_rep->type = pam_rep->type;
pwu_rep->scope = pam_rep->scope;
pwu_rep->scope_len = pam_rep->scope_len;
} else {
pwu_rep = PWU_DEFAULT_REP;
}
attr[0].type = ATTR_PASSWD; attr[0].next = &attr[1];
attr[1].type = ATTR_REP_NAME; attr[1].next = NULL;
result = __get_authtoken_attr(user, pwu_rep, attr);
if (pwu_rep != PWU_DEFAULT_REP)
free(pwu_rep);
if (result != PWU_SUCCESS) {
/*
* In the unlikely event that we can't obtain any info about
* the users password, we assume the most strict scenario.
*/
p->maxlength = _PASS_MAX_XPG;
} else {
char *oldpw = attr[0].data.val_s;
char *repository = attr[1].data.val_s;
if ((strcmp(repository, "files") == 0 ||
strcmp(repository, "nis") == 0) ||
p->server_policy == B_FALSE) {
char *salt;
/*
* We currently need to supply this dummy to
* crypt_gensalt(). This will change RSN.
*/
struct passwd dummy;
dummy.pw_name = user;
salt = crypt_gensalt(oldpw, &dummy);
if (salt && *salt == '$')
p->maxlength = _PASS_MAX;
else
p->maxlength = _PASS_MAX_XPG;
free(salt);
p->server_policy = B_FALSE; /* we perform checks */
} else {
/* not files or nis AND server_policy is set */
p->maxlength = _PASS_MAX;
}
free(attr[0].data.val_s);
free(attr[1].data.val_s);
}
/* sanity check of the configured parameters */
if (p->minlength < p->mindigit + p->minspecial + p->minnonalpha +
p->minalpha) {
syslog(LOG_ERR, "%s: pam_authtok_check: Defined minimum "
"password length (PASSLENGTH=%d) is less then minimum "
"characters in the various classes (%d)", progname,
p->minlength,
p->mindigit + p->minspecial + p->minnonalpha + p->minalpha);
p->minlength = p->mindigit + p->minspecial + p->minnonalpha +
p->minalpha;
syslog(LOG_ERR, "%s: pam_authtok_check: effective "
"PASSLENGTH set to %d.", progname, p->minlength);
/* this won't lead to failure */
}
if (p->maxlength < p->minlength) {
syslog(LOG_ERR, "%s: pam_authtok_check: The configured "
"minimum password length (PASSLENGTH=%d) is larger than "
"the number of significant characters the current "
"encryption algorithm uses (%d). See policy.conf(4) for "
"alternative password encryption algorithms.", progname);
/* this won't lead to failure */
}
return (PAM_SUCCESS);
}
/*
* free_passwd_defaults(struct pwdefaults *p)
*
* free space occupied by the defaults read from PWADMIN
*/
void
free_passwd_defaults(struct pwdefaults *p)
{
if (p && p->dicts)
free(p->dicts);
}
/*
* check_circular():
* This function return 1 if string "t" is a circular shift of
* string "s", else it returns 0. -1 is returned on failure.
* We also check to see if string "t" is a reversed-circular shift
* of string "s", i.e. "ABCDE" vs. "DCBAE".
*/
static int
check_circular(s, t)
char *s, *t;
{
char c, *p, *o, *r, *buff, *ubuff, *pubuff;
unsigned int i, j, k, l, m;
size_t len;
int ret = 0;
i = strlen(s);
l = strlen(t);
if (i != l)
return (0);
len = i + 1;
buff = malloc(len);
ubuff = malloc(len);
pubuff = malloc(len);
if (buff == NULL || ubuff == NULL || pubuff == NULL) {
syslog(LOG_ERR, "pam_authtok_check: out of memory.");
return (-1);
}
m = 2;
o = &ubuff[0];
for (p = s; c = *p++; *o++ = c)
if (islower(c))
c = toupper(c);
*o = '\0';
o = &pubuff[0];
for (p = t; c = *p++; *o++ = c)
if (islower(c))
c = toupper(c);
*o = '\0';
p = &ubuff[0];
while (m--) {
for (k = 0; k < i; k++) {
c = *p++;
o = p;
l = i;
r = &buff[0];
while (--l)
*r++ = *o++;
*r++ = c;
*r = '\0';
p = &buff[0];
if (strcmp(p, pubuff) == 0) {
ret = 1;
goto out;
}
}
p = p + i;
r = &ubuff[0];
j = i;
while (j--)
*--p = *r++; /* reverse test-string for m==0 pass */
}
out:
(void) memset(buff, 0, len);
(void) memset(ubuff, 0, len);
(void) memset(pubuff, 0, len);
free(buff);
free(ubuff);
free(pubuff);
return (ret);
}
/*
* count the different character classes present in the password.
*/
int
check_composition(char *pw, struct pwdefaults *pwdef, pam_handle_t *pamh,
int flags)
{
uint_t alpha_cnt = 0;
uint_t upper_cnt = 0;
uint_t lower_cnt = 0;
uint_t special_cnt = 0;
uint_t whitespace_cnt = 0;
uint_t digit_cnt = 0;
uint_t maxrepeat = 0;
uint_t repeat = 1;
int ret = 0;
char *progname;
char errmsg[256];
char lastc = '\0';
uint_t significant = pwdef->maxlength;
char *w;
(void) pam_get_item(pamh, PAM_SERVICE, (void **)&progname);
/* go over the password gathering statistics */
for (w = pw; significant != 0 && *w != '\0'; w++, significant--) {
if (isalpha(*w)) {
alpha_cnt++;
if (isupper(*w)) {
upper_cnt++;
} else {
lower_cnt++;
}
} else if (isspace(*w))
whitespace_cnt++;
else if (isdigit(*w))
digit_cnt++;
else
special_cnt++;
if (*w == lastc) {
if (++repeat > maxrepeat)
maxrepeat = repeat;
} else {
repeat = 1;
}
lastc = *w;
}
/*
* If we only consider part of the password (the first maxlength
* characters) we give a modified error message. Otherwise, a
* user entering FooBar1234 with PASSLENGTH=6, MINDIGIT=4, while
* we're using the default UNIX crypt (8 chars significant),
* would not understand what's going on when he's told that
* "The password should contain at least 4 digits"...
* Instead, we now well him
* "The first 8 characters of the password should contain at least
* 4 digits."
*/
if (pwdef->maxlength < strlen(pw))
/*
* TRANSLATION_NOTE
* - Make sure the % and %% come over intact
* - The last %%s will be replaced by strings like
* "alphabetic character(s)"
* "numeric or special character(s)"
* "special character(s)"
* "digit(s)"
* "uppercase alpha character(s)"
* "lowercase alpha character(s)"
* So the final string written to the user might become
* "passwd: The first 8 characters of the password must contain
* at least 4 uppercase alpha characters(s)"
*/
(void) snprintf(errmsg, sizeof (errmsg), dgettext(TEXT_DOMAIN,
"%s: The first %d characters of the password must "
"contain at least %%d %%s."), progname, pwdef->maxlength);
else
/*
* TRANSLATION_NOTE
* - Make sure the % and %% come over intact
* - The last %%s will be replaced by strings like
* "alphabetic character(s)"
* "numeric or special character(s)"
* "special character(s)"
* "digit(s)"
* "uppercase alpha character(s)"
* "lowercase alpha character(s)"
* So the final string written to the user might become
* "passwd: The password must contain at least 4 uppercase
* alpha characters(s)"
*/
(void) snprintf(errmsg, sizeof (errmsg), dgettext(TEXT_DOMAIN,
"%s: The password must contain at least %%d %%s."),
progname);
/* Check for whitespace first since it influences special counts */
if (whitespace_cnt > 0 && pwdef->whitespace == B_FALSE) {
error(pamh, flags, dgettext(TEXT_DOMAIN,
"%s: Whitespace characters are not allowed."), progname);
ret = 1;
goto out;
}
/*
* Once we get here, whitespace_cnt is either 0, or whitespaces are
* to be treated a special characters.
*/
if (alpha_cnt < pwdef->minalpha) {
error(pamh, flags, errmsg, pwdef->minalpha,
dgettext(TEXT_DOMAIN, "alphabetic character(s)"));
ret = 1;
goto out;
}
if (pwdef->minnonalpha > 0) {
/* specials are defined by MINNONALPHA */
/* nonalpha = special+whitespace+digit */
if ((special_cnt + whitespace_cnt + digit_cnt) <
pwdef->minnonalpha) {
error(pamh, flags, errmsg, pwdef->minnonalpha,
dgettext(TEXT_DOMAIN,
"numeric or special character(s)"));
ret = 1;
goto out;
}
} else {
/* specials are defined by MINSPECIAL and/or MINDIGIT */
if ((special_cnt + whitespace_cnt) < pwdef->minspecial) {
error(pamh, flags, errmsg, pwdef->minspecial,
dgettext(TEXT_DOMAIN, "special character(s)"));
ret = 1;
goto out;
}
if (digit_cnt < pwdef->mindigit) {
error(pamh, flags, errmsg, pwdef->mindigit,
dgettext(TEXT_DOMAIN, "digit(s)"));
ret = 1;
goto out;
}
}
if (upper_cnt < pwdef->minupper) {
error(pamh, flags, errmsg, pwdef->minupper,
dgettext(TEXT_DOMAIN, "uppercase alpha character(s)"));
ret = 1;
goto out;
}
if (lower_cnt < pwdef->minlower) {
error(pamh, flags, errmsg, pwdef->minlower,
dgettext(TEXT_DOMAIN, "lowercase alpha character(s)"));
ret = 1;
goto out;
}
if (pwdef->maxrepeat > 0 && maxrepeat > pwdef->maxrepeat) {
error(pamh, flags, dgettext(TEXT_DOMAIN,
"%s: Too many consecutively repeating characters. "
"Maximum allowed is %d."), progname, pwdef->maxrepeat);
ret = 1;
}
out:
return (ret);
}
/*
* make sure that old and new password differ by at least 'mindiff'
* positions. Return 0 if OK, 1 otherwise
*/
int
check_diff(char *pw, char *opw, struct pwdefaults *pwdef, pam_handle_t *pamh,
int flags)
{
size_t pwlen, opwlen, max;
unsigned int diff; /* difference between old and new */
if (opw == NULL)
opw = "";
max = pwdef->maxlength;
pwlen = MIN(strlen(pw), max);
opwlen = MIN(strlen(opw), max);
if (pwlen > opwlen)
diff = pwlen - opwlen;
else
diff = opwlen - pwlen;
while (*opw != '\0' && *pw != '\0' && max-- != 0) {
if (*opw != *pw)
diff++;
opw++;
pw++;
}
if (diff < pwdef->mindiff) {
char *progname;
(void) pam_get_item(pamh, PAM_SERVICE, (void **)&progname);
error(pamh, flags, dgettext(TEXT_DOMAIN,
"%s: The first %d characters of the old and new passwords "
"must differ by at least %d positions."), progname,
pwdef->maxlength, pwdef->mindiff);
return (1);
}
return (0);
}
/*
* check to see if password is in one way or another based on a
* dictionary word. Returns 0 if password is OK, 1 if it is based
* on a dictionary word and hence should be rejected.
*/
int
check_dictionary(char *pw, struct pwdefaults *pwdef, pam_handle_t *pamh,
int flags)
{
int crack_ret;
int ret;
char *progname;
(void) pam_get_item(pamh, PAM_SERVICE, (void **)&progname);
/* dictionary check isn't MT-safe */
(void) mutex_lock(&dictlock);
if (pwdef->dicts &&
make_dict_database(pwdef->dicts, pwdef->db_location) != 0) {
(void) mutex_unlock(&dictlock);
syslog(LOG_ERR, "pam_authtok_check:pam_sm_chauthtok: "
"Dictionary database not present.");
error(pamh, flags, dgettext(TEXT_DOMAIN,
"%s: password dictionary missing."), progname);
return (PAM_SYSTEM_ERR);
}
crack_ret = DictCheck(pw, pwdef->db_location);
(void) mutex_unlock(&dictlock);
switch (crack_ret) {
case DATABASE_OPEN_FAIL:
syslog(LOG_ERR, "pam_authtok_check:pam_sm_chauthtok: "
"dictionary database open failure: %s", strerror(errno));
error(pamh, flags, dgettext(TEXT_DOMAIN,
"%s: failed to open dictionary database."), progname);
ret = PAM_SYSTEM_ERR;
break;
case DICTIONARY_WORD:
error(pamh, flags, dgettext(TEXT_DOMAIN,
"%s: password is based on a dictionary word."), progname);
ret = PAM_AUTHTOK_ERR;
break;
case REVERSE_DICTIONARY_WORD:
error(pamh, flags, dgettext(TEXT_DOMAIN,
"%s: password is based on a reversed dictionary word."),
progname);
ret = PAM_AUTHTOK_ERR;
break;
default:
ret = PAM_SUCCESS;
break;
}
return (ret);
}
int
pam_sm_chauthtok(pam_handle_t *pamh, int flags, int argc, const char **argv)
{
int debug = 0;
int retcode = 0;
int force_check = 0;
int i;
size_t pwlen;
char *usrname;
char *pwbuf, *opwbuf;
pwu_repository_t *pwu_rep = PWU_DEFAULT_REP;
pam_repository_t *pwd_rep = NULL;
struct pwdefaults pwdef;
char *progname;
/* needs to be set before option processing */
pwdef.server_policy = B_FALSE;
for (i = 0; i < argc; i++) {
if (strcmp(argv[i], "debug") == 0)
debug = 1;
if (strcmp(argv[i], "force_check") == 0)
force_check = 1;
if (strcmp(argv[i], "server_policy") == 0)
pwdef.server_policy = B_TRUE;
}
if (debug)
syslog(LOG_AUTH | LOG_DEBUG,
"pam_authtok_check: pam_sm_chauthok called(%x) "
"force_check = %d", flags, force_check);
if ((flags & PAM_PRELIM_CHECK) == 0)
return (PAM_IGNORE);
(void) pam_get_item(pamh, PAM_SERVICE, (void **)&progname);
(void) pam_get_item(pamh, PAM_USER, (void **)&usrname);
if (usrname == NULL || *usrname == '\0') {
syslog(LOG_ERR, "pam_authtok_check: username name is empty");
return (PAM_USER_UNKNOWN);
}
(void) pam_get_item(pamh, PAM_AUTHTOK, (void **)&pwbuf);
(void) pam_get_item(pamh, PAM_OLDAUTHTOK, (void **)&opwbuf);
if (pwbuf == NULL)
return (PAM_AUTHTOK_ERR);
/* none of these checks holds if caller say so */
if ((flags & PAM_NO_AUTHTOK_CHECK) != 0 && force_check == 0)
return (PAM_SUCCESS);
/* read system-defaults */
retcode = get_passwd_defaults(pamh, usrname, &pwdef);
if (retcode != PAM_SUCCESS)
return (retcode);
if (debug) {
syslog(LOG_AUTH | LOG_DEBUG,
"pam_authtok_check: MAXLENGTH= %d, server_policy = %s",
pwdef.maxlength, pwdef.server_policy ? "true" : "false");
syslog(LOG_AUTH | LOG_DEBUG,
"pam_authtok_check: PASSLENGTH= %d", pwdef.minlength);
syslog(LOG_AUTH | LOG_DEBUG, "pam_authtok_check: NAMECHECK=%s",
pwdef.do_namecheck == B_TRUE ? "Yes" : "No");
syslog(LOG_AUTH | LOG_DEBUG,
"pam_authtok_check: do_dictcheck = %s\n",
pwdef.do_dictcheck ? "true" : "false");
if (pwdef.do_dictcheck) {
syslog(LOG_AUTH | LOG_DEBUG,
"pam_authtok_check: DICTIONLIST=%s",
(pwdef.dicts != NULL) ? pwdef.dicts : "<not set>");
syslog(LOG_AUTH | LOG_DEBUG,
"pam_authtok_check: DICTIONDBDIR=%s",
pwdef.db_location);
}
syslog(LOG_AUTH | LOG_DEBUG, "pam_authtok_check: MINDIFF=%d",
pwdef.mindiff);
syslog(LOG_AUTH | LOG_DEBUG,
"pam_authtok_check: MINALPHA=%d, MINNONALPHA=%d",
pwdef.minalpha, pwdef.minnonalpha);
syslog(LOG_AUTH | LOG_DEBUG,
"pam_authtok_check: MINSPECIAL=%d, MINDIGIT=%d",
pwdef.minspecial, pwdef.mindigit);
syslog(LOG_AUTH | LOG_DEBUG, "pam_authtok_check: WHITESPACE=%s",
pwdef.whitespace ? "YES" : "NO");
syslog(LOG_AUTH | LOG_DEBUG,
"pam_authtok_check: MINUPPER=%d, MINLOWER=%d",
pwdef.minupper, pwdef.minlower);
syslog(LOG_AUTH | LOG_DEBUG, "pam_authtok_check: MAXREPEATS=%d",
pwdef.maxrepeat);
}
/*
* If server policy is still true (might be changed from the
* value specified in /etc/pam.conf by get_passwd_defaults()),
* we return ignore and let the server do all the checks.
*/
if (pwdef.server_policy == B_TRUE) {
free_passwd_defaults(&pwdef);
return (PAM_IGNORE);
}
/*
* XXX: JV: we can't really make any assumption on the length of
* the password that will be used by the crypto algorithm.
* for UNIX-style encryption, minalpha=5,minnonalpha=5 might
* be impossible, but not for MD5 style hashes... what to do?
*
* since we don't know what alg. will be used, we operate on
* the password as entered, so we don't sanity check anything
* for now.
*/
/*
* Make sure new password is long enough
*/
pwlen = strlen(pwbuf);
if (pwlen < pwdef.minlength) {
error(pamh, flags, dgettext(TEXT_DOMAIN,
"%s: Password too short - must be at least %d "
"characters."), progname, pwdef.minlength);
free_passwd_defaults(&pwdef);
return (PAM_AUTHTOK_ERR);
}
/* Make sure the password doesn't equal--a shift of--the username */
if (pwdef.do_namecheck) {
switch (check_circular(usrname, pwbuf)) {
case 1:
error(pamh, flags, dgettext(TEXT_DOMAIN,
"%s: Password cannot be circular shift of "
"logonid."), progname);
free_passwd_defaults(&pwdef);
return (PAM_AUTHTOK_ERR);
case -1:
free_passwd_defaults(&pwdef);
return (PAM_BUF_ERR);
default:
break;
}
}
/* Check if new password is in history list. */
(void) pam_get_item(pamh, PAM_REPOSITORY, (void **)&pwd_rep);
if (pwd_rep != NULL) {
if ((pwu_rep = calloc(1, sizeof (*pwu_rep))) == NULL)
return (PAM_BUF_ERR);
pwu_rep->type = pwd_rep->type;
pwu_rep->scope = pwd_rep->scope;
pwu_rep->scope_len = pwd_rep->scope_len;
}
if (__check_history(usrname, pwbuf, pwu_rep) == PWU_SUCCESS) {
/* password found in history */
error(pamh, flags, dgettext(TEXT_DOMAIN,
"%s: Password in history list."), progname);
if (pwu_rep != PWU_DEFAULT_REP)
free(pwu_rep);
free_passwd_defaults(&pwdef);
return (PAM_AUTHTOK_ERR);
}
if (pwu_rep != PWU_DEFAULT_REP)
free(pwu_rep);
/* check MINALPHA, MINLOWER, etc. */
if (check_composition(pwbuf, &pwdef, pamh, flags) != 0) {
free_passwd_defaults(&pwdef);
return (PAM_AUTHTOK_ERR);
}
/* make sure the old and new password are not too much alike */
if (check_diff(pwbuf, opwbuf, &pwdef, pamh, flags) != 0) {
free_passwd_defaults(&pwdef);
return (PAM_AUTHTOK_ERR);
}
/* dictionary check */
if (pwdef.do_dictcheck) {
retcode = check_dictionary(pwbuf, &pwdef, pamh, flags);
if (retcode != PAM_SUCCESS) {
free_passwd_defaults(&pwdef);
return (retcode);
}
}
free_passwd_defaults(&pwdef);
/* password has passed all tests: it's strong enough */
return (PAM_SUCCESS);
}