Balazs Scheidler <[EMAIL PROTECTED]> writes:
> one of my never-completed hack projects was an FTP server. I had a global
> variable holding the sent password (which is available under lsh as well
> in case password authentication is used), and faking the communication
> with the user. (e.g. when PAM asked for password, simply feed it the value
> of that given global variable) This was ugly, but worked.
Ok, you could do something like that, but it's still difficult to do a
decent mapping between PAM conversation and SSH messages. For
instance, if there is a PAM module to send a banner message to the
user before the login promt, this hack would have to distinguish
between the login prompt (which should be discarded) and the banner
message, which should be sent the the client as a USERAUTH_BANNER
message. And even if that works, the banner message would be displayed
to the user *after* that she has entered her password, which is not
what was intended. Or consider password change requests.
PAM and ssh user authentication have many features in common, but they
are severely incompatible. Using them together loses the flexibility
and power of both.
> if shadow support is based on runtime detection and _not_ a compile time
> option we have the same functionality. I don't like programs that need to
> be recompiled when simple passwd is converted to shadow file.
If you look at the configure.in, you will see that lsh checks for two
shadow related things: It tests if shadow.h can be included, and if
the linker can find the getspnam function. The idea is that if the
system supports shadow passwords at all, it should automatically be
compiled into lsh; if shadow passwords were actually in use when lsh
was compiled should not matter.
Do you think that is good enough? If we really want to, we could
always let lshd dlopen some pluggable authentication modules of its
own ;-)
The runtime detection is basically
#ifdef HAVE_GETSPNAM
if (passwd->pw_passwd && !strcmp(passwd->pw_passwd, "x"))
{
if (!(shadowpwd = getspnam(name->data)))
{
KILL(res);
return 0;
}
res->passwd = format_cstring(shadowpwd->sp_pwdp);
}
else
#endif /* HAVE_GETSPNAM */
res->passwd = format_cstring(passwd->pw_passwd);
(I don't know much about the shadow mechanism myself. Keresztfalvi
Gabor Agoston helped me with the code above, i.e. he should have the
credits if it works, and I should be blamed if it doesn't).
/Niels
