|
|
#include <sys/types.h> #include <prot.h>int smp_check_user(typ, name, term, invoker, usrpp, pwtryp, reasonp, from_nis, delayp) int typ; char *name; char *term; uid_t invoker; struct smp_user_info **usrpp; int *pwtryp; char **reasonp; int *from_nis; int *delayp;
typ can be one of SMP_LOGIN or SMP_PASSWD depending on the service to be used by the caller. If typ is not set to SMP_PASSWD, the invoker parameter is not used and memory for the corresponding protected password information is not allocated.
term must be the full pathname of the login terminal (which can be determined using ttyname(S-osr5)). If term is not set to NULL, the device assignment database and terminal control database entries are queried. If term is found in the device assignment database then that entry is used as the tty login, otherwise the last pathname component of term is used. The terminal control database is checked to ensure that term can be used for login.
If any of the following occur, a flag is set indicating that the terminal is locked:
If typ is specified as SMP_PASSWD, invoker is the UID of the user who invoked the calling process (which can be determined using getuid(S-osr5)). If valid, the corresponding protected password information is retrieved and stored for use in subsequent password authority checks.
pwtryp points to an integer which represents the maximum number of attempts that can be made to pick an acceptable password. If this integer is zero it is replaced with the system default value. Setting pwtryp to a value greater than zero, allows the system default value to be overridden. In this case, the integer pointed to by pwtryp is set to the larger of the specified number and the system default minimum number of tries.
In the special case where name is equal to root and the derived value of the terminal specified by term is equal to the value of OVERRIDE (from /etc/default/login) or console by default, a flag is set which indicates that the calling program wishes the service to be provided for root on the system console. If this flag is set certain conditions which would normally prevent a login or password change (such as a corrupted database or a locked terminal) are ignored so that the condition can be corrected.
reasonp is used with certain return values to store a descriptive message.
from_nis points to one of the following integers: ``1'' indicates that the returned smp_check_user structure was obtained from NIS; ``0'' indicates that the returned smp_check_user\*(> structure was obtained from local files. See ``Configuring the Network Information Service (NIS)'' in Administering the Network Information Service (NIS) for more information.
delayp points to an integer that returns the delay, in seconds, that should be enforced after a failed login attempt. This delay enhances system security by hindering automated password probing attempts. The value is set by the system administrator. See ``Setting login restrictions on terminals'' in Administering users and groups for more information.
However, in all of the above cases the ``root on console'' flag has been set and login will be permitted in order to correct the problem. reasonp points to a character string explaining the type of failure.
Cannot access terminal control database entrySecurity database corruptMissing target protected password informationMissing subject protected password informationAccount lockedTerminal lockedAccount retired#include <sys/types.h>
#include <prot.h>
...
{
char line[AUTH_MAX_PASSWD_LENGTH+1], newpw[AUTH_MAX_PASSWD_LENGTH+1];
struct smp_user_info *userp;
int pwtype, result, pwtries = 0;
int from_nis, delay;
char *reason, **environ, *shell;
set_auth_parameters(argc, argv);
put("login: ");
switch (smp_check_user(SMP_LOGIN, gets(line), ttyname(0), 0, &userp,
&pwtries, &reason, &from_nis, &delay)) {
case SMP_FAIL:
put("out of memory\n");
sleep(delay);
exit(1);
case SMP_EXTFAIL:
put(reason);
put("\n");
sleep(delay);
exit(1);
case SMP_NOTAUTH:
put("not authorised\n"); /* can't read auth database */
sleep(delay);
exit(1);
case SMP_TERMLOCK:
put("terminal locked\n");
smp_audit_fail(userp);
sleep(delay);
exit(1);
case SMP_ACCTLOCK:
put("account locked\n");
smp_audit_fail(userp);
sleep(delay);
exit(1);
case SMP_RETIRED:
put("account retired\n");
smp_audit_fail(userp);
sleep(delay);
exit(1);
case SMP_OVERRIDE:
put(reason);
put("\nroot login on console is allowed\n");
case SMP_NULLPW:
break;
case SMP_BADUSER:
case SMP_HASPW:
noecho();
put("password: ");
switch (smp_check_pw(gets(line), userp, &reason)) {
/* either allow access, or say why not and sleep(delay) */
...
}
echo();
case SMP_PWREQ:
put("\nmust set password now\n");
if ((pwtype=smp_pw_choice(userp, &reason)) == SMP_CHOOSE) {
...
}
...
}
...
}