Le système est fonctionnel, aussi avec des jolis fichiers de build.
This commit is contained in:
Mysaa Java
parent
a3a72a9549
commit
00c9059776
8
Makefile
8
Makefile
@ -2,10 +2,10 @@
|
||||
|
||||
all: bash-gitonly pam_oath_key.so auth-keys-gen
|
||||
|
||||
nargv/argvt.o: nargv/nargv.c
|
||||
gcc -c nargv/nargv.c -o nargv/argvt.o
|
||||
bash-gitonly: nargv/argvt.o bash-gitonly.c
|
||||
gcc bash-gitonly.c nargv/argvt.o -I . -L/usr/server/postgresql/lib -I/usr/server/postgresql/include -lpq -o bash-gitonly
|
||||
argvt.o: nargv/nargv.c
|
||||
gcc -c nargv/nargv.c -o argvt.o
|
||||
bash-gitonly: argvt.o bash-gitonly.c
|
||||
gcc bash-gitonly.c argvt.o -I . -L/usr/server/postgresql/lib -I/usr/server/postgresql/include -lpq -o bash-gitonly
|
||||
|
||||
pam_oath_key.so: pam_oath_key.c
|
||||
gcc pam_oath_key.c -I/usr/system/include/ -I/usr/server/postgresql/include/ -L/usr/server/postgresql/lib/ -L/usr/libraries/lib/ -shared -lpam -lpq -loath -fPIC -o pam_oath_key.so
|
||||
|
||||
10
authKeysPg.c
10
authKeysPg.c
@ -20,7 +20,7 @@ exit_nicely(PGconn *conn)
|
||||
int
|
||||
main(int argc, char **argv)
|
||||
{
|
||||
|
||||
|
||||
PGconn *conn;
|
||||
PGresult *res;
|
||||
int nFields;
|
||||
@ -40,7 +40,7 @@ main(int argc, char **argv)
|
||||
|
||||
dbPassFile = fopen(BDD_PASS_FILE,"r");
|
||||
if (dbPassFile == NULL) {
|
||||
fprintf(stderr,"Cannot open file %s, on peut pas se connecter à la base de données pour lister les clés en tant que %d -> fopen error %d\n", BDD_PASS_FILE,getegid(),errno);
|
||||
fprintf(stderr,"Cannot open file %s, on peut pas se connecter à la base de données pour lister les clés en tant que %d -> fopen error %d\n", BDD_PASS_FILE,geteuid(),errno);
|
||||
return 1;
|
||||
}
|
||||
while (feof(dbPassFile))
|
||||
@ -88,15 +88,15 @@ main(int argc, char **argv)
|
||||
nFields = PQnfields(res);
|
||||
|
||||
fprintf(stderr, PQerrorMessage(conn));
|
||||
|
||||
/* puis affiche les lignes */
|
||||
for (i = 0; i < PQntuples(res); i++)
|
||||
{
|
||||
printf("environement=\"GIT_USERID=%s\" %s %s\n", (int) PQgetvalue(res,i,0),PQgetvalue(res,i,1),PQgetvalue(res,i,2));
|
||||
printf("%s %s\n",PQgetvalue(res,i,1),PQgetvalue(res,i,2));
|
||||
}
|
||||
|
||||
PQclear(res);
|
||||
|
||||
|
||||
fprintf(stderr,"La liste des clés a été envoyée\n");
|
||||
/* ferme la connexion à la base et nettoie */
|
||||
PQfinish(conn);
|
||||
return 0;
|
||||
|
||||
@ -43,6 +43,7 @@ char* isCmdAuthorized(char* cmd){
|
||||
|
||||
int main(int argc, char **argv, char **envp){
|
||||
|
||||
/*
|
||||
fprintf(stderr,"Received argv:\n");
|
||||
for(int i=0;i<argc;i++)
|
||||
{
|
||||
@ -54,6 +55,7 @@ int main(int argc, char **argv, char **envp){
|
||||
char *thisEnv = *env;
|
||||
fprintf(stderr,"%s\n", thisEnv);
|
||||
}
|
||||
*/
|
||||
// Ce bout de code est ultra-restrictif et risque de planter si SSH change. Le message sera alors reconaissable.
|
||||
if(argc !=3 || (strcmp(argv[0],AUTHORIZED_SHELL_COMMAND)!=0 && strcmp(argv[0],COMMANDS_PATH AUTHORIZED_SHELL_COMMAND)) || strcmp(argv[1],AUTHORIZED_SHELL_FLAG)!=0){
|
||||
fprintf(stderr, ANSI_COLOR_GREEN "Pas de bash ici, il vous faut un «vrai» accès SSH" ANSI_COLOR_RESET "\n");
|
||||
@ -100,7 +102,7 @@ int main(int argc, char **argv, char **envp){
|
||||
|
||||
dbPassFile = fopen(BDD_PASS_FILE,"r");
|
||||
if (dbPassFile == NULL) {
|
||||
fprintf(stderr,ANSI_COLOR_GREEN "Cannot open file %s, on peut pas se connecter à la base de données" ANSI_COLOR_RESET "\n",BDD_PASS_FILE);
|
||||
fprintf(stderr,ANSI_COLOR_GREEN "Cannot open file %s, on peut pas se connecter à la base de données en tant que l'uid %d" ANSI_COLOR_RESET "\n",BDD_PASS_FILE,geteuid());
|
||||
return 1;
|
||||
}
|
||||
while (feof(dbPassFile))
|
||||
@ -146,10 +148,10 @@ int main(int argc, char **argv, char **envp){
|
||||
nFields = PQntuples(res);
|
||||
// Il y a toujours une seule valeur retournée, renvoie NULL si il n'y a rien
|
||||
char* niveauAutorisation;
|
||||
niveauAutorisation=PQgetvalue(res, 0, 0);
|
||||
niveauAutorisation = PQgetvalue(res, 0, 0);
|
||||
PQclear(res);
|
||||
PQfinish(conn);
|
||||
fprintf(stderr,ANSI_COLOR_GREEN "Autorisation: sur %s pour %s -> %s" ANSI_COLOR_RESET "\n",userID,repoName,niveauAutorisation);
|
||||
fprintf(stderr,ANSI_COLOR_GREEN "Autorisation: sur %s pour l'id %s -> %s" ANSI_COLOR_RESET "\n",repoName,userID,niveauAutorisation);
|
||||
if(niveauAutorisation[0]=='\0'){// If the string is empty i.e. NULL authorisations
|
||||
fprintf(stderr,ANSI_COLOR_GREEN "Vous n'avez pas le droit d'accéder à ce repo. Il n'existe peut-être même pas ..." ANSI_COLOR_RESET "\n");
|
||||
return 1;
|
||||
|
||||
@ -8,6 +8,8 @@
|
||||
#include <unistd.h>
|
||||
#include <sys/types.h>
|
||||
|
||||
#include <arpa/inet.h> //Pour la conversion bigendian/littleendian
|
||||
|
||||
|
||||
// These #defines must be present according to PAM documentation.
|
||||
#define PAM_SM_AUTH
|
||||
@ -33,7 +35,7 @@
|
||||
#define PAM_EXTERN extern
|
||||
|
||||
// Static options
|
||||
#define BDD_PASS_FILE "/srv/bdd/pipi-system.pass2"
|
||||
#define BDD_PASS_FILE "/srv/bdd/pipi-system.pass"
|
||||
#define BDD_CONN_LENGTH 255
|
||||
#define MIN_OTP_LEN 6
|
||||
#define DEFAULT_OTP_LEN 6
|
||||
@ -49,6 +51,16 @@ struct cfg {
|
||||
int window;
|
||||
};
|
||||
|
||||
static void copyUntilEndline(const char * src, char dest[]){
|
||||
int c = 0;
|
||||
while(*src!='\0' && *src!='\n'){
|
||||
dest[c] = *src;
|
||||
src++;
|
||||
c++;
|
||||
}
|
||||
dest[c] = '\0';
|
||||
}
|
||||
|
||||
static void
|
||||
parse_cfg(int flags, int argc,
|
||||
const char ** argv, struct cfg * cfg) {
|
||||
@ -133,13 +145,15 @@ pam_sm_authenticate(pam_handle_t * pamh, int flags, int argc, const char ** argv
|
||||
PGconn *conn;
|
||||
PGresult *res;
|
||||
int nFields;
|
||||
int gitUserID;
|
||||
char * oathSecret;
|
||||
|
||||
FILE* stderr2 = fopen("/tmp/pam-oath.log","w");
|
||||
|
||||
D(("Running the oath authenticator !\n"));
|
||||
fprintf(stderr2,"Ca a au moins passé l'init ...");
|
||||
|
||||
fprintf(stderr2,"Ca a au moins passé l'init ...\n");
|
||||
|
||||
|
||||
|
||||
/***** Parsing config *****/
|
||||
parse_cfg(flags, argc, argv, & cfg);
|
||||
@ -151,23 +165,26 @@ pam_sm_authenticate(pam_handle_t * pamh, int flags, int argc, const char ** argv
|
||||
goto done;
|
||||
}
|
||||
DBG(("We got the user: %s", user));
|
||||
fprintf(stderr2,"Le user est là ! %s", user);
|
||||
fprintf(stderr2,"Le user est là ! %s\n", user);
|
||||
|
||||
/****** Getting ssh key ******/
|
||||
|
||||
/* Retrieve SSH authentication information. */
|
||||
const char * ssh_auth_info_ret = pam_getenv(pamh, "SSH_AUTH_INFO_0");
|
||||
char ssh_auth_info [SSH_AUTH_INFO_LEN];
|
||||
//ssh_auth_info_ret = "pubkey ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKXQt1YWjKCsjcsFW7o1hdjAB/qxWBwesAeV0RcBeW0I";
|
||||
ssh_auth_info_ret = "pubkey ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILNTOkgZXdTFzWOC9R1Aeuq30B3lG+Eq8nL76tZsJ9Qn\n c aca prout caca";
|
||||
|
||||
if (!ssh_auth_info || !*ssh_auth_info) {
|
||||
fprintf(stderr2,"Les infos que j'ai récupéré: %s;;\n", ssh_auth_info_ret);
|
||||
|
||||
if (!ssh_auth_info_ret || !*ssh_auth_info_ret) {
|
||||
DBG(("No SSH auth info, impossible de traiter"));
|
||||
return PAM_IGNORE;
|
||||
return PAM_AUTHINFO_UNAVAIL;
|
||||
}
|
||||
strcpy(ssh_auth_info,ssh_auth_info_ret);
|
||||
|
||||
copyUntilEndline(ssh_auth_info_ret,ssh_auth_info);
|
||||
|
||||
DBG(("Infos de connection: %s",ssh_auth_info));
|
||||
|
||||
|
||||
const char delim = ' ';
|
||||
|
||||
char * authType = ssh_auth_info;
|
||||
@ -179,6 +196,7 @@ pam_sm_authenticate(pam_handle_t * pamh, int flags, int argc, const char ** argv
|
||||
DBG(("Authentification KeyVal: '%s'", sshKeyVal));
|
||||
|
||||
|
||||
|
||||
rc = oath_init();
|
||||
if (rc != OATH_OK) {
|
||||
DBG(("oath_init() failed (%d)", rc));
|
||||
@ -193,10 +211,9 @@ pam_sm_authenticate(pam_handle_t * pamh, int flags, int argc, const char ** argv
|
||||
char ch;
|
||||
int pos = strlen(connInfo);
|
||||
|
||||
printf("WOW ! Mais c'est génial ici !");
|
||||
dbPassFile = fopen(BDD_PASS_FILE,"r");
|
||||
if (dbPassFile == NULL) {
|
||||
DBG(("Cannot open file %s, on peut pas se connecter à la base de données avec l'UID %s\n", BDD_PASS_FILE, geteuid()));
|
||||
DBG(("Cannot open file %s, on peut pas se connecter à la base de données avec l'UID %s\n", BDD_PASS_FILE, getuid()));
|
||||
retval = PAM_AUTHINFO_UNAVAIL;
|
||||
goto done;
|
||||
}
|
||||
@ -208,6 +225,7 @@ pam_sm_authenticate(pam_handle_t * pamh, int flags, int argc, const char ** argv
|
||||
fclose(dbPassFile);
|
||||
connInfo[pos] = '\'';
|
||||
|
||||
fprintf(stderr2,"On se connecte à la bdd\n");
|
||||
|
||||
|
||||
conn = PQconnectdb(connInfo);
|
||||
@ -228,17 +246,17 @@ pam_sm_authenticate(pam_handle_t * pamh, int flags, int argc, const char ** argv
|
||||
goto done;
|
||||
}
|
||||
|
||||
DBG(("Initialisation de la base de données efféctuée"));
|
||||
|
||||
DBG(("Initialisation de la base de données efféctuée\n"));
|
||||
fprintf(stderr2,"Initialisation de la connection à la bdd effectuée\n");
|
||||
PQclear(res);
|
||||
|
||||
const char *paramValues[2];
|
||||
paramValues[0] = sshKeyType;
|
||||
paramValues[1] = sshKeyVal;
|
||||
|
||||
res = PQexecParams(conn, "SELECT \"oathPrivate\" FROM git.keys WHERE \"sshKeyType\"=$1 AND \"sshPubKey\"=$2",2,NULL,paramValues,NULL,NULL,1);
|
||||
res = PQexecParams(conn, "SELECT \"userID\",\"oathPrivate\" FROM git.keys WHERE \"sshKeyType\"=$1 AND \"sshPubKey\"=$2",2,NULL,paramValues,NULL,NULL,1);
|
||||
if (PQresultStatus(res) != PGRES_TUPLES_OK) {
|
||||
DBG(("SET failed: %s", PQerrorMessage(conn)));
|
||||
DBG(("Impossible de faire la requete à la BDD: %s", PQerrorMessage(conn)));
|
||||
PQclear(res);
|
||||
retval = PAM_AUTH_ERR;
|
||||
goto done;
|
||||
@ -252,10 +270,15 @@ pam_sm_authenticate(pam_handle_t * pamh, int flags, int argc, const char ** argv
|
||||
goto done;
|
||||
}
|
||||
|
||||
oathSecret=PQgetvalue(res, 0, 0);
|
||||
gitUserID = ntohl(*((int*)PQgetvalue(res, 0, 0)));
|
||||
oathSecret = PQgetvalue(res, 0, 1);
|
||||
|
||||
DBG(("On a récupéré le code secret : %s",oathSecret));
|
||||
|
||||
if(PQgetisnull(res, 0, 0)==1){
|
||||
printf("Le champ est bien nul !\n");
|
||||
}
|
||||
|
||||
PQclear(res);
|
||||
PQfinish(conn);
|
||||
|
||||
@ -364,12 +387,15 @@ pam_sm_authenticate(pam_handle_t * pamh, int flags, int argc, const char ** argv
|
||||
|
||||
retval = PAM_SUCCESS;
|
||||
|
||||
|
||||
// On met l'id de l'utisateur pour les autorisations
|
||||
char envStr[11+8];
|
||||
sprintf(envStr, "GIT_USERID=%d",gitUserID);
|
||||
pam_putenv(pamh,envStr);
|
||||
|
||||
|
||||
/****** Terminé ! ******/
|
||||
done:
|
||||
|
||||
fclose(stderr2);
|
||||
oath_done();
|
||||
free(query_prompt);
|
||||
free(onlypasswd);
|
||||
@ -379,10 +405,10 @@ pam_sm_authenticate(pam_handle_t * pamh, int flags, int argc, const char ** argv
|
||||
return retval;
|
||||
}
|
||||
|
||||
|
||||
PAM_EXTERN
|
||||
int pam_sm_setcred(pam_handle_t *pamh,int flags,int argc
|
||||
,const char **argv)
|
||||
,const char **argv)
|
||||
{
|
||||
return PAM_SUCCESS;
|
||||
}
|
||||
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user