diff options
Diffstat (limited to 'modules/pam_ftp')
| -rw-r--r-- | modules/pam_ftp/.cvsignore | 6 | ||||
| -rw-r--r-- | modules/pam_ftp/Makefile.am | 31 | ||||
| -rw-r--r-- | modules/pam_ftp/README | 52 | ||||
| -rw-r--r-- | modules/pam_ftp/README.xml | 41 | ||||
| -rw-r--r-- | modules/pam_ftp/pam_ftp.8 | 95 | ||||
| -rw-r--r-- | modules/pam_ftp/pam_ftp.8.xml | 183 | ||||
| -rw-r--r-- | modules/pam_ftp/pam_ftp.c | 233 | ||||
| -rwxr-xr-x | modules/pam_ftp/tst-pam_ftp | 2 |
8 files changed, 0 insertions, 643 deletions
diff --git a/modules/pam_ftp/.cvsignore b/modules/pam_ftp/.cvsignore deleted file mode 100644 index 9fb98574..00000000 --- a/modules/pam_ftp/.cvsignore +++ /dev/null @@ -1,6 +0,0 @@ -*.la -*.lo -.deps -.libs -Makefile -Makefile.in diff --git a/modules/pam_ftp/Makefile.am b/modules/pam_ftp/Makefile.am deleted file mode 100644 index e6d510a1..00000000 --- a/modules/pam_ftp/Makefile.am +++ /dev/null @@ -1,31 +0,0 @@ -# -# Copyright (c) 2005, 2006 Thorsten Kukuk <kukuk@suse.de> -# - -CLEANFILES = *~ - -EXTRA_DIST = README $(MANS) $(XMLS) tst-pam_ftp - -man_MANS = pam_ftp.8 -XMLS = README.xml pam_ftp.8.xml - -securelibdir = $(SECUREDIR) -secureconfdir = $(SCONFIGDIR) - -AM_CFLAGS = -I$(top_srcdir)/libpam/include -I$(top_srcdir)/libpamc/include -AM_LDFLAGS = -no-undefined -avoid-version -module \ - -L$(top_builddir)/libpam -lpam -if HAVE_VERSIONING - AM_LDFLAGS += -Wl,--version-script=$(srcdir)/../modules.map -endif - -securelib_LTLIBRARIES = pam_ftp.la - -TESTS = tst-pam_ftp - -if ENABLE_REGENERATE_MAN -noinst_DATA = README -README: pam_ftp.8.xml --include $(top_srcdir)/Make.xml.rules -endif - diff --git a/modules/pam_ftp/README b/modules/pam_ftp/README deleted file mode 100644 index 15f4130e..00000000 --- a/modules/pam_ftp/README +++ /dev/null @@ -1,52 +0,0 @@ -pam_ftp — PAM module for anonymous access module - -━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ - -DESCRIPTION - -pam_ftp is a PAM module which provides a pluggable anonymous ftp mode of -access. - -This module intercepts the user's name and password. If the name is ftp or -anonymous, the user's password is broken up at the @ delimiter into a PAM_RUSER -and a PAM_RHOST part; these pam-items being set accordingly. The username ( -PAM_USER) is set to ftp. In this case the module succeeds. Alternatively, the -module sets the PAM_AUTHTOK item with the entered password and fails. - -This module is not safe and easily spoofable. - -OPTIONS - -debug - - Print debug information. - -ignore - - Pay no attention to the email address of the user (if supplied). - -ftp=XXX,YYY,... - - Instead of ftp or anonymous, provide anonymous login to the comma separated - list of users: XXX,YYY,.... Should the applicant enter one of these - usernames the returned username is set to the first in the list: XXX. - -EXAMPLES - -Add the following line to /etc/pam.d/ftpd to handle ftp style anonymous login: - -# -# ftpd; add ftp-specifics. These lines enable anonymous ftp over -# standard UN*X access (the listfile entry blocks access to -# users listed in /etc/ftpusers) -# -auth sufficient pam_ftp.so -auth required pam_unix.so use_first_pass -auth required pam_listfile.so \ - onerr=succeed item=user sense=deny file=/etc/ftpusers - - -AUTHOR - -pam_ftp was written by Andrew G. Morgan <morgan@kernel.org>. - diff --git a/modules/pam_ftp/README.xml b/modules/pam_ftp/README.xml deleted file mode 100644 index 65de28e3..00000000 --- a/modules/pam_ftp/README.xml +++ /dev/null @@ -1,41 +0,0 @@ -<?xml version="1.0" encoding='UTF-8'?> -<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" -"http://www.docbook.org/xml/4.3/docbookx.dtd" -[ -<!-- -<!ENTITY pamaccess SYSTEM "pam_ftp.8.xml"> ---> -]> - -<article> - - <articleinfo> - - <title> - <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" - href="pam_ftp.8.xml" xpointer='xpointer(//refnamediv[@id = "pam_ftp-name"]/*)'/> - </title> - - </articleinfo> - - <section> - <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" - href="pam_ftp.8.xml" xpointer='xpointer(//refsect1[@id = "pam_ftp-description"]/*)'/> - </section> - - <section> - <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" - href="pam_ftp.8.xml" xpointer='xpointer(//refsect1[@id = "pam_ftp-options"]/*)'/> - </section> - - <section> - <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" - href="pam_ftp.8.xml" xpointer='xpointer(//refsect1[@id = "pam_ftp-examples"]/*)'/> - </section> - - <section> - <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" - href="pam_ftp.8.xml" xpointer='xpointer(//refsect1[@id = "pam_ftp-author"]/*)'/> - </section> - -</article> diff --git a/modules/pam_ftp/pam_ftp.8 b/modules/pam_ftp/pam_ftp.8 deleted file mode 100644 index 0c730267..00000000 --- a/modules/pam_ftp/pam_ftp.8 +++ /dev/null @@ -1,95 +0,0 @@ -.\" Title: pam_ftp -.\" Author: -.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/> -.\" Date: 06/09/2006 -.\" Manual: Linux\-PAM Manual -.\" Source: Linux\-PAM Manual -.\" -.TH "PAM_FTP" "8" "06/09/2006" "Linux\-PAM Manual" "Linux\-PAM Manual" -.\" disable hyphenation -.nh -.\" disable justification (adjust text to left margin only) -.ad l -.SH "NAME" -pam_ftp \- PAM module for anonymous access module -.SH "SYNOPSIS" -.HP 11 -\fBpam_ftp.so\fR [debug] [ignore] [users=\fIXXX,YYY,\fR...] -.SH "DESCRIPTION" -.PP -pam_ftp is a PAM module which provides a pluggable anonymous ftp mode of access. -.PP -This module intercepts the user's name and password. If the name is -\fIftp\fR -or -\fIanonymous\fR, the user's password is broken up at the -\fI@\fR -delimiter into a -\fIPAM_RUSER\fR -and a -\fIPAM_RHOST\fR -part; these pam\-items being set accordingly. The username (\fIPAM_USER\fR) is set to -\fIftp\fR. In this case the module succeeds. Alternatively, the module sets the -\fIPAM_AUTHTOK\fR -item with the entered password and fails. -.PP -This module is not safe and easily spoofable. -.SH "OPTIONS" -.PP -.TP 3n -\fBdebug\fR -Print debug information. -.TP 3n -\fBignore\fR -Pay no attention to the email address of the user (if supplied). -.TP 3n -\fBftp=\fR\fB\fIXXX,YYY,...\fR\fR -Instead of -\fIftp\fR -or -\fIanonymous\fR, provide anonymous login to the comma separated list of users: -\fB\fIXXX,YYY,...\fR\fR. Should the applicant enter one of these usernames the returned username is set to the first in the list: -\fIXXX\fR. -.SH "MODULE SERVICES PROVIDED" -.PP -Only the -\fBauth\fR -service is supported. -.SH "RETURN VALUES" -.PP -.TP 3n -PAM_SUCCESS -The authentication was successfull. -.TP 3n -PAM_USER_UNKNOWN -User not known. -.SH "EXAMPLES" -.PP -Add the following line to -\fI/etc/pam.d/ftpd\fR -to handle ftp style anonymous login: -.sp -.RS 3n -.nf -# -# ftpd; add ftp\-specifics. These lines enable anonymous ftp over -# standard UN*X access (the listfile entry blocks access to -# users listed in /etc/ftpusers) -# -auth sufficient pam_ftp.so -auth required pam_unix.so use_first_pass -auth required pam_listfile.so \\ - onerr=succeed item=user sense=deny file=/etc/ftpusers - -.fi -.RE -.sp -.SH "SEE ALSO" -.PP - -\fBpam.conf\fR(5), -\fBpam.d\fR(8), -\fBpam\fR(8) -.SH "AUTHOR" -.PP -pam_ftp was written by Andrew G. Morgan <morgan@kernel.org>. diff --git a/modules/pam_ftp/pam_ftp.8.xml b/modules/pam_ftp/pam_ftp.8.xml deleted file mode 100644 index aca21694..00000000 --- a/modules/pam_ftp/pam_ftp.8.xml +++ /dev/null @@ -1,183 +0,0 @@ -<?xml version="1.0" encoding='UTF-8'?> -<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" - "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd"> - -<refentry id="pam_ftp"> - - <refmeta> - <refentrytitle>pam_ftp</refentrytitle> - <manvolnum>8</manvolnum> - <refmiscinfo class="sectdesc">Linux-PAM Manual</refmiscinfo> - </refmeta> - - <refnamediv id="pam_ftp-name"> - <refname>pam_ftp</refname> - <refpurpose>PAM module for anonymous access module</refpurpose> - </refnamediv> - - <refsynopsisdiv> - <cmdsynopsis id="pam_ftp-cmdsynopsis"> - <command>pam_ftp.so</command> - <arg choice="opt"> - debug - </arg> - <arg choice="opt"> - ignore - </arg> - <arg choice="opt" rep='repeat'> - users=<replaceable>XXX,YYY,</replaceable> - </arg> - </cmdsynopsis> - </refsynopsisdiv> - - <refsect1 id="pam_ftp-description"> - - <title>DESCRIPTION</title> - - <para> - pam_ftp is a PAM module which provides a pluggable - anonymous ftp mode of access. - </para> - <para> - This module intercepts the user's name and password. If the name is - <emphasis>ftp</emphasis> or <emphasis>anonymous</emphasis>, the - user's password is broken up at the <emphasis>@</emphasis> delimiter - into a <emphasis>PAM_RUSER</emphasis> and a - <emphasis>PAM_RHOST</emphasis> part; these pam-items being set - accordingly. The username (<emphasis>PAM_USER</emphasis>) is set - to <emphasis>ftp</emphasis>. In this case the module succeeds. - Alternatively, the module sets the <emphasis>PAM_AUTHTOK</emphasis> - item with the entered password and fails. - </para> - <para> - This module is not safe and easily spoofable. - </para> - </refsect1> - - <refsect1 id="pam_ftp-options"> - - <title>OPTIONS</title> - <para> - <variablelist> - - <varlistentry> - <term> - <option>debug</option> - </term> - <listitem> - <para> - Print debug information. - </para> - </listitem> - </varlistentry> - - <varlistentry> - <term> - <option>ignore</option> - </term> - <listitem> - <para> - Pay no attention to the email address of the user - (if supplied). - </para> - </listitem> - </varlistentry> - - <varlistentry> - <term> - <option>ftp=<replaceable>XXX,YYY,...</replaceable></option> - </term> - <listitem> - <para> - Instead of <emphasis>ftp</emphasis> or - <emphasis>anonymous</emphasis>, provide anonymous login - to the comma separated list of users: - <option><replaceable>XXX,YYY,...</replaceable></option>. - Should the applicant enter - one of these usernames the returned username is set to - the first in the list: <emphasis>XXX</emphasis>. - </para> - </listitem> - </varlistentry> - - </variablelist> - - </para> - </refsect1> - - <refsect1 id="pam_ftp-services"> - <title>MODULE SERVICES PROVIDED</title> - <para> - Only the <option>auth</option> service is supported. - </para> - </refsect1> - - <refsect1 id='pam_ftp-return_values'> - <title>RETURN VALUES</title> - <para> - <variablelist> - - <varlistentry> - <term>PAM_SUCCESS</term> - <listitem> - <para> - The authentication was successfull. - </para> - </listitem> - </varlistentry> - - <varlistentry> - <term>PAM_USER_UNKNOWN</term> - <listitem> - <para> - User not known. - </para> - </listitem> - </varlistentry> - - </variablelist> - </para> - </refsect1> - - <refsect1 id='pam_ftp-examples'> - <title>EXAMPLES</title> - <para> - Add the following line to <filename>/etc/pam.d/ftpd</filename> to - handle ftp style anonymous login: - <programlisting> -# -# ftpd; add ftp-specifics. These lines enable anonymous ftp over -# standard UN*X access (the listfile entry blocks access to -# users listed in /etc/ftpusers) -# -auth sufficient pam_ftp.so -auth required pam_unix.so use_first_pass -auth required pam_listfile.so \ - onerr=succeed item=user sense=deny file=/etc/ftpusers - </programlisting> - </para> - </refsect1> - - <refsect1 id='pam_ftp-see_also'> - <title>SEE ALSO</title> - <para> - <citerefentry> - <refentrytitle>pam.conf</refentrytitle><manvolnum>5</manvolnum> - </citerefentry>, - <citerefentry> - <refentrytitle>pam.d</refentrytitle><manvolnum>8</manvolnum> - </citerefentry>, - <citerefentry> - <refentrytitle>pam</refentrytitle><manvolnum>8</manvolnum> - </citerefentry> - </para> - </refsect1> - - <refsect1 id='pam_ftp-author'> - <title>AUTHOR</title> - <para> - pam_ftp was written by Andrew G. Morgan <morgan@kernel.org>. - </para> - </refsect1> - -</refentry> diff --git a/modules/pam_ftp/pam_ftp.c b/modules/pam_ftp/pam_ftp.c deleted file mode 100644 index 4f4231c2..00000000 --- a/modules/pam_ftp/pam_ftp.c +++ /dev/null @@ -1,233 +0,0 @@ -/* pam_ftp module */ - -/* - * $Id$ - * - * Written by Andrew Morgan <morgan@linux.kernel.org> 1996/3/11 - * - */ - -#define PLEASE_ENTER_PASSWORD "Password required for %s." -#define GUEST_LOGIN_PROMPT "Guest login ok, " \ -"send your complete e-mail address as password." - -/* the following is a password that "can't be correct" */ -#define BLOCK_PASSWORD "\177BAD PASSWPRD\177" - -#include "config.h" - -#include <stdio.h> -#include <stdlib.h> -#include <unistd.h> -#include <syslog.h> -#include <stdarg.h> -#include <string.h> - -/* - * here, we make a definition for the externally accessible function - * in this file (this definition is required for static a module - * but strongly encouraged generally) it is used to instruct the - * modules include file to define the function prototypes. - */ - -#define PAM_SM_AUTH - -#include <security/pam_modules.h> -#include <security/_pam_macros.h> -#include <security/pam_ext.h> - -/* argument parsing */ - -#define PAM_DEBUG_ARG 01 -#define PAM_IGNORE_EMAIL 02 -#define PAM_NO_ANON 04 - -static int -_pam_parse(pam_handle_t *pamh, int argc, const char **argv, const char **users) -{ - int ctrl=0; - - /* step through arguments */ - for (ctrl=0; argc-- > 0; ++argv) { - - /* generic options */ - - if (!strcmp(*argv,"debug")) - ctrl |= PAM_DEBUG_ARG; - else if (!strncmp(*argv,"users=",6)) { - *users = 6 + *argv; - } else if (!strcmp(*argv,"ignore")) { - ctrl |= PAM_IGNORE_EMAIL; - } else { - pam_syslog(pamh, LOG_ERR, "unknown option: %s", *argv); - } - } - - return ctrl; -} - -/* - * check if name is in list or default list. place users name in *_user - * return 1 if listed 0 if not. - */ - -static int lookup(const char *name, const char *list, const char **_user) -{ - int anon = 0; - - *_user = name; /* this is the default */ - if (list && *list) { - const char *l; - char *list_copy, *x; - - list_copy = x_strdup(list); - x = list_copy; - while (list_copy && (l = strtok(x, ","))) { - x = NULL; - if (!strcmp(name, l)) { - *_user = list; - anon = 1; - } - } - _pam_overwrite(list_copy); - _pam_drop(list_copy); - } else { -#define MAX_L 2 - static const char *l[MAX_L] = { "ftp", "anonymous" }; - int i; - - for (i=0; i<MAX_L; ++i) { - if (!strcmp(l[i], name)) { - *_user = l[0]; - anon = 1; - break; - } - } - } - - return anon; -} - -/* --- authentication management functions (only) --- */ - -PAM_EXTERN int -pam_sm_authenticate (pam_handle_t *pamh, int flags UNUSED, - int argc, const char **argv) -{ - int retval, anon=0, ctrl; - const char *user; - const char *users = NULL; - - /* - * this module checks if the user name is ftp or annonymous. If - * this is the case, it can set the PAM_RUSER to the entered email - * address and SUCCEEDS, otherwise it FAILS. - */ - - ctrl = _pam_parse(pamh, argc, argv, &users); - - retval = pam_get_user(pamh, &user, NULL); - if (retval != PAM_SUCCESS || user == NULL) { - pam_syslog(pamh, LOG_ERR, "no user specified"); - return PAM_USER_UNKNOWN; - } - - if (!(ctrl & PAM_NO_ANON)) { - anon = lookup(user, users, &user); - } - - if (anon) { - retval = pam_set_item(pamh, PAM_USER, (const void *)user); - if (retval != PAM_SUCCESS || user == NULL) { - pam_syslog(pamh, LOG_ERR, "user resetting failed"); - return PAM_USER_UNKNOWN; - } - } - - /* - * OK. we require an email address for user or the user's password. - * - build conversation and get their input. - */ - - { - char *resp = NULL; - const char *token; - - if (!anon) - retval = pam_prompt (pamh, PAM_PROMPT_ECHO_OFF, &resp, - PLEASE_ENTER_PASSWORD, user); - else - retval = pam_prompt (pamh, PAM_PROMPT_ECHO_OFF, &resp, - GUEST_LOGIN_PROMPT); - - if (retval != PAM_SUCCESS) { - _pam_drop (resp); - return ((retval == PAM_CONV_AGAIN) - ? PAM_INCOMPLETE:PAM_AUTHINFO_UNAVAIL); - } - - if (anon) { - /* XXX: Some effort should be made to verify this email address! */ - - if (!(ctrl & PAM_IGNORE_EMAIL)) { - token = strtok(resp, "@"); - retval = pam_set_item(pamh, PAM_RUSER, token); - - if ((token) && (retval == PAM_SUCCESS)) { - token = strtok(NULL, "@"); - retval = pam_set_item(pamh, PAM_RHOST, token); - } - } - - /* we are happy to grant annonymous access to the user */ - retval = PAM_SUCCESS; - - } else { - /* - * we have a password so set AUTHTOK - */ - - pam_set_item(pamh, PAM_AUTHTOK, resp); - - /* - * this module failed, but the next one might succeed with - * this password. - */ - - retval = PAM_AUTH_ERR; - } - - /* clean up */ - _pam_drop(resp); - - /* success or failure */ - - return retval; - } -} - -PAM_EXTERN int -pam_sm_setcred (pam_handle_t *pamh UNUSED, int flags UNUSED, - int argc UNUSED, const char **argv UNUSED) -{ - return PAM_IGNORE; -} - - -#ifdef PAM_STATIC - -/* static module data */ - -struct pam_module _pam_ftp_modstruct = { - "pam_ftp", - pam_sm_authenticate, - pam_sm_setcred, - NULL, - NULL, - NULL, - NULL, -}; - -#endif - -/* end of module definition */ diff --git a/modules/pam_ftp/tst-pam_ftp b/modules/pam_ftp/tst-pam_ftp deleted file mode 100755 index 1a4f67c7..00000000 --- a/modules/pam_ftp/tst-pam_ftp +++ /dev/null @@ -1,2 +0,0 @@ -#!/bin/sh -../../tests/tst-dlopen .libs/pam_ftp.so |