1 /* $OpenBSD: check_expire.c,v 1.8 2004/04/20 23:21:23 millert Exp $ */
2
3 /*
4 * Copyright (c) 1997 Berkeley Software Design, Inc. All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * 3. All advertising materials mentioning features or use of this software
15 * must display the following acknowledgement:
16 * This product includes software developed by Berkeley Software Design,
17 * Inc.
18 * 4. The name of Berkeley Software Design, Inc. may not be used to endorse
19 * or promote products derived from this software without specific prior
20 * written permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY BERKELEY SOFTWARE DESIGN, INC. ``AS IS'' AND
23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED. IN NO EVENT SHALL BERKELEY SOFTWARE DESIGN, INC. BE LIABLE
26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 * SUCH DAMAGE.
33 *
34 * BSDI $From: check_expire.c,v 2.1 1997/08/08 18:38:25 prb Exp $
35 */
36
37 #include <sys/types.h>
38
39 #include <errno.h>
40 #include <fcntl.h>
41 #include <pwd.h>
42 #include <signal.h>
43 #include <stdio.h>
44 #include <stdlib.h>
45 #include <string.h>
46 #include <syslog.h>
47 #include <time.h>
48 #include <tzfile.h>
49 #include <login_cap.h>
50 #include <bsd_auth.h>
51
52 #include "util.h"
53
54 static char *pwd_update(const struct passwd *, const struct passwd *);
55
56 int
login_check_expire(FILE * back,struct passwd * pwd,char * class,int lastchance)57 login_check_expire(FILE *back, struct passwd *pwd, char *class, int lastchance)
58 {
59 auth_session_t *as;
60 login_cap_t *lc;
61 quad_t dead, expire, warn;
62 char *p;
63
64 if ((as = auth_open()) == NULL) {
65 syslog(LOG_ERR, "failed to create auth session");
66 return (1);
67 }
68 if (auth_setpwd(as, pwd) < 0) {
69 syslog(LOG_ERR, "failed to set pwd entry in auth session");
70 return (1);
71 }
72
73 expire = auth_check_change(as);
74 auth_close(as);
75
76 if (expire != 0) {
77 fprintf(back, BI_VALUE " expire %qd\n", expire);
78
79 if (class == NULL)
80 class = pwd->pw_class;
81
82 if ((lc = login_getclass(class)) == NULL) {
83 dead = 0;
84 warn = 0;
85 } else {
86 dead = login_getcaptime(lc, "password-dead", 0, 0);
87 warn = login_getcaptime(lc, "password-warn",
88 2 * DAYSPERWEEK * SECSPERDAY,
89 2 * DAYSPERWEEK * SECSPERDAY);
90 if (dead < 0) {
91 syslog(LOG_ERR, "class %s password-dead is %qd",
92 lc->lc_class, dead);
93 dead = 0;
94 }
95 if (warn < 0) {
96 syslog(LOG_ERR, "class %s password-warn is %qd",
97 lc->lc_class, warn);
98 warn = 0;
99 }
100 }
101 login_close(lc);
102
103 /*
104 * If their password is dead (expired longer than
105 * password-dead) then just reject them. If it is
106 * expired but not dead yet, reject them with a
107 * PWEXPIRED so login knows they can still sort of
108 * get in.
109 */
110 if (expire < -dead) {
111 syslog(LOG_WARNING, "%s: dead password", pwd->pw_name);
112 fprintf(back, BI_VALUE
113 " errormsg Your password has expired\n");
114 fprintf(back, BI_REJECT "\n");
115 return (1);
116 }
117 if (expire < 0) {
118 if (lastchance) {
119 struct passwd *npwd;
120
121 endpwent();
122
123 /*
124 * Only let them play this game once.
125 * Set their password change time to 1.
126 * This will most certainly cause any
127 * expired password to be dead, as well.
128 */
129 npwd = pw_dup(pwd);
130 npwd->pw_change = 1;
131 p = pwd_update(npwd, pwd);
132 memset(npwd->pw_passwd, 0,
133 strlen(npwd->pw_passwd));
134 free(npwd);
135 if (p != NULL) {
136 fprintf(back, BI_VALUE " errormsg %s",
137 auth_mkvalue(p));
138 fprintf(back, BI_REJECT "\n");
139 return (1);
140 }
141 }
142 syslog(LOG_WARNING, "%s: expired password", pwd->pw_name);
143 fprintf(back, BI_VALUE
144 " errormsg Your password has expired\n");
145 fprintf(back, BI_PWEXPIRED "\n");
146 return (1);
147 }
148
149 /*
150 * If their password is not expired but is about to expire
151 * then warn them.
152 */
153 if (expire <= warn) {
154 fprintf(back, BI_VALUE
155 " warnmsg Your password expires on %s\n",
156 ctime(&pwd->pw_change));
157 }
158 }
159 return (0);
160 }
161
162 static char *
pwd_update(const struct passwd * pwd,const struct passwd * opwd)163 pwd_update(const struct passwd *pwd, const struct passwd *opwd)
164 {
165 int tfd, pfd;
166
167 pw_init();
168 tfd = pw_lock(0);
169 if (tfd < 0) {
170 if (errno == EEXIST)
171 return("the passwd file is busy.");
172 else
173 return("can't open passwd temp file");
174 }
175
176 pfd = open(_PATH_MASTERPASSWD, O_RDONLY, 0);
177 if (pfd < 0 || fcntl(pfd, F_SETFD, 1) == -1) {
178 pw_abort();
179 return(strerror(errno));
180 }
181
182 pw_copy(pfd, tfd, pwd, opwd);
183 if (pw_mkdb(pwd->pw_name, 0) < 0) {
184 pw_abort();
185 return("unable to update password database");
186 }
187
188 return(NULL);
189 }
190