Subject: AIX authenticate() support for wu-ftpd Beta 18

From: Edward Geraghty <[email-masked]>
Date: Thu, 9 Jul 1998 22:12:34 -0400

Hey all,

 Here are some diffs to allow AIX to use the authenticate() function
which allows wuftp to authenticate with DCE/AFS/kerberos/Skey whatever. This is
similar to PAM support on Sun..(it think Pluggable authentication modules).

 Change #1 - existing authenticate() to myauthenticate()

 Change #2 - Added aix_authenticate function with does login for AIX
authenticate function.

Let me know if there is a problem.. The authenticate() function supports
multiple passwords
for complete authentication. From what I see FTP protocol only supports 1
password,
1 username and 1 account name... So when authenticate() wants another password
I just
return Invalid login.. Is there a better way to handle it?

EdGy

-------------------------------------------------------------------------------------
$ diff -c authenticate.c.orig authenticate.c
*** authenticate.c.orig Thu Jul  9 15:53:25 1998
--- authenticate.c      Thu Jul  9 15:53:56 1998
***************
*** 67,73 ****
   * variable.
   */
  int
! authenticate()
  {

  #if USE_A_RFC931
--- 67,73 ----
   * variable.
   */
  int
! myauthenticate()
  {

  #if USE_A_RFC931

$ diff -c ftpd.c.orig ftpd.c
*** ftpd.c.orig Thu Jul  9 15:54:05 1998
--- ftpd.c      Thu Jul  9 16:05:51 1998
***************
*** 361,366 ****
--- 361,370 ----
  int ultrix_check_pass(char *passwd, char *xpasswd);
  #endif

+ #ifdef AIX
+ int aix_authenticate(char *passwd);
+ #endif
+
  /* ls program commands and options for lreplies on and off */
  char  ls_long[50];
  char  ls_short[50];
***************
*** 742,748 ****
        hostname[sizeof(hostname)-1]='\0';
      }
      access_init();
!     authenticate();
      conv_init();
  #ifdef VIRTUAL
      virtual_len = sizeof(virtual_addr);
--- 746,752 ----
        hostname[sizeof(hostname)-1]='\0';
      }
      access_init();
!     myauthenticate();
      conv_init();
  #ifdef VIRTUAL
      virtual_len = sizeof(virtual_addr);
***************
*** 1522,1537 ****
  #endif
  #endif
  #endif
  #ifdef ULTRIX_AUTH
          if ((numfails = ultrix_check_pass(passwd, xpasswd)) >= 0) {
  #else
          /* The strcmp does not catch null passwords! */
        if (pw !=NULL && *pw->pw_passwd != '\0' &&
  #ifdef HAS_PW_EXPIRE
          (pw->pw_expire && time(NULL) < pw->pw_expire) &&
! #endif
            strcmp(xpasswd, pw->pw_passwd) == 0) {
! #endif
            rval = 0;
             }
          if(rval){
--- 1526,1546 ----
  #endif
  #endif
  #endif
+
  #ifdef ULTRIX_AUTH
          if ((numfails = ultrix_check_pass(passwd, xpasswd)) >= 0) {
  #else
+ #ifdef AIX
+         if (aix_authenticate(passwd)) {
+ #else
          /* The strcmp does not catch null passwords! */
        if (pw !=NULL && *pw->pw_passwd != '\0' &&
  #ifdef HAS_PW_EXPIRE
          (pw->pw_expire && time(NULL) < pw->pw_expire) &&
! #endif /* HAS_PW_EXPIRE */
            strcmp(xpasswd, pw->pw_passwd) == 0) {
! #endif /* AIX */
! #endif /* ULTRIX_AUTH */
            rval = 0;
             }
          if(rval){
***************
*** 4032,4034 ****
--- 4041,4077 ----
      return -1;
  }
  #endif /* ULTRIX_AUTH */
+
+
+ #ifdef AIX
+
+ /*
+  * Using AIX authenticate() - wuftp can authenitcate with password
files/NIS/DCE/AFS or
+  * or AIX integrated authorization method.  AIX authenticate() will return 0
on SUCCESS
+  * and non-zero on failure.  If authenticate() sets reenter to a non-zero
value, then
+  * AIX requires * additional information to authenticate the user. Since FTP
only supports
+  * one password challenge, all we can do it complain and bail. [email-masked]
+  */
+ int aix_authenticate(char *passwd) {
+    int  rc, reenter;
+    char *message;
+
+    rc = authenticate(pw->pw_name, passwd, &reenter, &message);
+
+    /*
+     * Check to see if authenticate() requires another password challenge
then
+     * complain.
+     */
+    if (reenter) {
+       syslog(LOG_NOTICE, "extended authentication not supported for user %s",
+             pw->pw_name);
+       rc = 1;
+      }
+
+    if (message != (char *) NULL)
+       free(message);
+
+    return ((rc) ? 0 : 1);
+   }
+ #endif /* AIX */
+

EdGy