13 #include <security/pam_modules.h>
15 #define DEF_INSTANCE "autologin"
38 static void log(int prio, char *format, ...)
43 va_start(args, format);
44 snprintf(buf, sizeof(buf), "pam_krb5auto[%i]: %s", getpid(), format);
45 vsyslog(prio, buf, args);
49 static struct options *parseopts(int argc, const char **argv)
54 opts = malloc(sizeof(*opts));
55 memset(opts, 0, sizeof(*opts));
56 for(i = 0; i < argc; i++) {
57 if(!strncmp(argv[i], "realm=", 6))
58 opts->realm = strdup(argv[i] + 6);
59 if(!strncmp(argv[i], "instance=", 9))
60 opts->instance = strdup(argv[i] + 9);
61 if(!strncmp(argv[i], "keytab=", 7))
62 opts->keytab = strdup(argv[i] + 7);
63 if(!strncmp(argv[i], "renew=", 6))
64 opts->renewable = atoi(argv[i] + 6);
65 if(!strcmp(argv[i], "forwardable"))
66 opts->forwardable = 1;
67 if(!strcmp(argv[i], "debug"))
73 static void freeopts(struct options *opts)
75 if(opts->realm != NULL)
77 if(opts->instance != NULL)
79 if(opts->keytab != NULL)
84 static void freedata(struct data *data)
87 krb5_free_cred_contents(data->ctx, &data->initcreds);
89 krb5_cc_close(data->ctx, data->cc);
91 krb5_free_principal(data->ctx, data->me);
93 krb5_free_context(data->ctx);
97 static void cleanupdata(pam_handle_t *pamh, struct data *data, int error_status)
102 static struct data *getdata(pam_handle_t *pamh, struct options *opts)
107 const char *user, *instance;
108 struct passwd *pwent;
111 pam_get_data(pamh, "krb5auto-data", (const void **)&data);
114 log(LOG_DEBUG, "creating new instance");
115 data = malloc(sizeof(*data));
116 memset(data, 0, sizeof(*data));
117 pam_get_user(pamh, &user, NULL);
119 log(LOG_ERR, "could not get user name");
124 if((pwent = getpwnam(user)) == NULL) {
125 log(LOG_ERR, "could not user information for `%s': %s", user, (errno == 0)?"user not found":strerror(errno));
129 data->uid = pwent->pw_uid;
130 data->gid = pwent->pw_gid;
131 if((ret = krb5_init_context(&data->ctx)) != 0) {
132 log(LOG_CRIT, "could not create krb5 context: %s", error_message(ret));
137 instance = opts->instance;
139 instance = DEF_INSTANCE;
141 snprintf(buf, sizeof(buf), "%s/%s@%s", user, instance, opts->realm);
143 snprintf(buf, sizeof(buf), "%s/%s", user, instance);
144 if((ret = krb5_parse_name(data->ctx, buf, &data->me)) != 0) {
145 log(LOG_ERR, "could not parse principal name `%s': %s", buf, error_message(ret));
149 pam_set_data(pamh, "krb5auto-data", data, (void (*)(pam_handle_t *, void *, int))cleanupdata);
154 static int savecreds(pam_handle_t *pamh, struct options *opts, struct data *data)
158 krb5_get_init_creds_opt icopts;
159 char buf[1024], *ccname, *filename;
161 krb5_get_init_creds_opt_init(&icopts);
165 if((ret = krb5_kt_resolve(data->ctx, opts->keytab, &kt)) != 0) {
166 log(LOG_ERR, "could not resolve keytab `%s': %s", opts->keytab, error_message(ret));
167 ret = PAM_SERVICE_ERR;
171 log(LOG_DEBUG, "using keytab `%s'", opts->keytab);
173 krb5_get_init_creds_opt_set_forwardable(&icopts, opts->forwardable);
174 krb5_get_init_creds_opt_set_renew_life(&icopts, opts->renewable);
176 krb5_free_cred_contents(data->ctx, &data->initcreds);
179 if((ret = krb5_get_init_creds_keytab(data->ctx, &data->initcreds, data->me, kt, 0, NULL, &icopts)) != 0) {
180 log(LOG_ERR, "could not get credentials: %s", error_message(ret));
181 ret = PAM_SERVICE_ERR;
186 log(LOG_DEBUG, "got creds successfully");
187 snprintf(buf, sizeof(buf), "KRB5CCNAME=FILE:/tmp/krb5cc_%i_XXXXXX", data->uid);
188 ccname = buf + sizeof("KRB5CCNAME=") - 1;
189 filename = ccname + sizeof("FILE:") - 1;
190 if((fd = mkstemp(filename)) < 0) {
191 log(LOG_ERR, "could not create tempfile for credentials cache: %s", strerror(errno));
192 ret = PAM_SERVICE_ERR;
197 log(LOG_DEBUG, "created ccache `%s'", filename);
198 if((ret = krb5_cc_resolve(data->ctx, ccname, &data->cc)) != 0) {
199 log(LOG_ERR, "could not resolve ccache `%s': %s", ccname, error_message(ret));
201 ret = PAM_SERVICE_ERR;
204 if((ret = krb5_cc_initialize(data->ctx, data->cc, data->me)) != 0) {
205 log(LOG_ERR, "could not initialize credentials cache `%s': %s", ccname, error_message(ret));
207 ret = PAM_SERVICE_ERR;
210 if((ret = krb5_cc_store_cred(data->ctx, data->cc, &data->initcreds)) != 0) {
211 log(LOG_ERR, "could not store credentials: %s", error_message(ret));
213 ret = PAM_SERVICE_ERR;
216 chown(filename, data->uid, data->gid);
217 pam_putenv(pamh, strdup(buf));
219 log(LOG_DEBUG, "successfully initialized ccache");
224 krb5_kt_close(data->ctx, kt);
228 static int delcreds(pam_handle_t *pamh, struct options *opts, struct data *data)
231 log(LOG_DEBUG, "deleting credentials");
233 krb5_free_cred_contents(data->ctx, &data->initcreds);
236 log(LOG_DEBUG, "freed internal creds");
238 if(data->cc != NULL) {
239 krb5_cc_destroy(data->ctx, data->cc);
242 log(LOG_DEBUG, "destroyed ccache");
247 PAM_EXTERN int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const char **argv)
249 struct options *opts;
251 opts = parseopts(argc, argv);
253 log(LOG_DEBUG, "pam_sm_authenticate called");
258 PAM_EXTERN int pam_sm_setcred(pam_handle_t *pamh, int flags, int argc, const char **argv)
260 struct options *opts;
264 opts = parseopts(argc, argv);
266 log(LOG_DEBUG, "pam_sm_setcred called");
267 data = getdata(pamh, opts);
269 log(LOG_ERR, "could not get data, erroring out");
270 return(PAM_SERVICE_ERR);
272 ret = PAM_SERVICE_ERR;
273 if(flags & PAM_ESTABLISH_CRED) {
274 ret = savecreds(pamh, opts, data);
275 } else if(flags & PAM_DELETE_CRED) {
276 ret = delcreds(pamh, opts, data);
284 * compile-command: "gcc -Wall -g --shared -fPIC -o pam_krb5auto.so pam_krb5auto.c -lkrb5"