From: tedu Date: Mon, 19 May 2014 15:05:13 +0000 (+0000) Subject: kerberos leftovers X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=7692f5f0b8e1ff836d8f3e9dbf51174095f66410;p=openbsd kerberos leftovers --- diff --git a/usr.bin/passwd/krb5_passwd.c b/usr.bin/passwd/krb5_passwd.c deleted file mode 100644 index 982b5ec5625..00000000000 --- a/usr.bin/passwd/krb5_passwd.c +++ /dev/null @@ -1,146 +0,0 @@ -/* - * Copyright (c) 1997-2000 Kungliga Tekniska Högskolan - * (Royal Institute of Technology, Stockholm, Sweden). - * All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * - * 3. Neither the name of the Institute nor the names of its contributors - * may be used to endorse or promote products derived from this software - * without specific prior written permission. - * - * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND - * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE - * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE - * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL - * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS - * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT - * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY - * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF - * SUCH DAMAGE. - */ - -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include - -/* RCSID("$KTH: kpasswd.c,v 1.23 2000/12/31 07:48:34 assar Exp $"); */ - -int krb5_passwd(int, char **); - -int -krb5_passwd(int argc, char **argv) -{ - krb5_data result_code_string, result_string; - krb5_get_init_creds_opt *opt; - krb5_principal principal; - krb5_context context; - krb5_error_code ret; - char pwbuf[BUFSIZ]; - krb5_creds cred; - int result_code; - uid_t uid; - - uid = getuid(); - if (setresuid(uid, uid, uid)) { - errx(1, "can't drop privileges\n"); - } - - ret = krb5_init_context(&context); - if (ret) - errx(1, "krb5_init_context failed: %d", ret); - - ret = krb5_get_init_creds_opt_alloc (context, &opt); - if (ret) - errx(1, "krb5_get_init_creds_opt_alloc failed: %d", ret); - - krb5_get_init_creds_opt_set_tkt_life (opt, 300); - krb5_get_init_creds_opt_set_forwardable (opt, FALSE); - krb5_get_init_creds_opt_set_proxiable (opt, FALSE); - - if (argv[0]) { - ret = krb5_parse_name(context, argv[0], &principal); - if (ret) { - krb5_get_init_creds_opt_free(context, opt); - krb5_err(context, 1, ret, "krb5_parse_name"); - } - } else { - ret = krb5_get_default_principal (context, &principal); - if (ret) { - krb5_get_init_creds_opt_free(context, opt); - krb5_err (context, 1, ret, "krb5_get_default_principal"); - } - } - - ret = krb5_get_init_creds_password (context, &cred, - principal, NULL, krb5_prompter_posix, NULL, 0, - "kadmin/changepw", opt); - krb5_get_init_creds_opt_free (context, opt); - switch (ret) { - case 0: - break; - case KRB5_LIBOS_PWDINTR : - return 1; - case KRB5KRB_AP_ERR_BAD_INTEGRITY : - case KRB5KRB_AP_ERR_MODIFIED : - krb5_errx(context, 1, "Password incorrect"); - break; - default: - krb5_err(context, 1, ret, "krb5_get_init_creds"); - } - - krb5_data_zero(&result_code_string); - krb5_data_zero(&result_string); - - if (UI_UTIL_read_pw_string(pwbuf, sizeof(pwbuf), "New password:", - 1) != 0) - return 1; - - ret = krb5_set_password (context, &cred, pwbuf, NULL, - &result_code, - &result_code_string, - &result_string); - if (ret) - krb5_err(context, 1, ret, "krb5_set_password"); - - printf ("%s%s%.*s\n", - krb5_passwd_result_to_string(context, result_code), - result_string.length > 0 ? " : " : "", - (int)result_string.length, - result_string.length > 0 ? (char *)result_string.data : ""); - - krb5_data_free(&result_code_string); - krb5_data_free(&result_string); - - krb5_free_cred_contents(context, &cred); - krb5_free_context(context); - return result_code; -} diff --git a/usr.bin/passwd/passwd.1 b/usr.bin/passwd/passwd.1 index 3375fc8924c..0e992624ed6 100644 --- a/usr.bin/passwd/passwd.1 +++ b/usr.bin/passwd/passwd.1 @@ -1,4 +1,4 @@ -.\" $OpenBSD: passwd.1,v 1.38 2014/04/24 19:07:54 jmc Exp $ +.\" $OpenBSD: passwd.1,v 1.39 2014/05/19 15:05:13 tedu Exp $ .\" .\" Copyright (c) 1990 The Regents of the University of California. .\" All rights reserved. @@ -29,7 +29,7 @@ .\" .\" from: @(#)passwd.1 6.11 (Berkeley) 7/24/91 .\" -.Dd $Mdocdate: April 24 2014 $ +.Dd $Mdocdate: May 19 2014 $ .Dt PASSWD 1 .Os .Sh NAME @@ -41,7 +41,7 @@ .Op Ar user .Sh DESCRIPTION .Nm -changes the user's local, Kerberos, or YP password. +changes the user's local or YP password. First, the user is prompted for their current password. If the current password is correctly typed, a new password is requested. The new password must be entered twice to avoid typing errors. @@ -62,17 +62,6 @@ variable in .Pp The options are as follows: .Bl -tag -width Ds -.It Fl K -Forces the change to affect the Kerberos 5 database, even -if the user has a password in the local database. -Once the password has been verified, -.Nm -communicates the new password information to the Kerberos authenticating host. -.Pp -The -.Ar user -argument specifies a principal and optional realm, for example -.Dq user@DOMAIN.COM . .It Fl l Causes the password to be updated only in the local password file. When changing only the local password, @@ -86,13 +75,8 @@ The daemon should be running on the YP master server. .El .Pp -This is the behavior if no flags are specified: -if Kerberos is active then -.Nm -will talk to the Kerberos server (even if the user has an entry -in the local database). -If the password is not in the local password database, then -an attempt is made to use the YP database. +If no flags are specified and the password is not in the local password +database, then an attempt is made to use the YP database. .Pp The superuser is not required to provide a user's current password if only the local password is modified. diff --git a/usr.bin/passwd/passwd.c b/usr.bin/passwd/passwd.c index d125171631b..9f789e08e72 100644 --- a/usr.bin/passwd/passwd.c +++ b/usr.bin/passwd/passwd.c @@ -1,4 +1,4 @@ -/* $OpenBSD: passwd.c,v 1.25 2009/10/27 23:59:41 deraadt Exp $ */ +/* $OpenBSD: passwd.c,v 1.26 2014/05/19 15:05:13 tedu Exp $ */ /* * Copyright (c) 1988 The Regents of the University of California. @@ -36,10 +36,6 @@ #include #include -#if defined(KRB5) -#include -#endif - /* * Note on configuration: * Generally one would not use both Kerberos and YP @@ -69,18 +65,6 @@ main(int argc, char **argv) #ifdef YP int status = 0; #endif -#if defined(KRB5) - char *ccfile; - struct stat sb; - - if (!(ccfile = getenv("KRB5CCNAME"))) - if (asprintf(&ccfile, "/tmp/krb5cc_%u", (unsigned)getuid()) == - -1) - errx(1, "out of memory"); - - if ((stat(ccfile, &sb) == 0) && (sb.st_uid == getuid())) - use_kerberos = 1; -#endif #ifdef YP use_yp = _yp_check(NULL); if (use_yp) { @@ -92,22 +76,12 @@ main(int argc, char **argv) #endif /* Process args and options */ - while ((ch = getopt(argc, argv, "lyK")) != -1) + while ((ch = getopt(argc, argv, "ly")) != -1) switch (ch) { case 'l': /* change local password file */ use_kerberos = 0; use_yp = 0; break; - case 'K': -#if defined(KRB5) - /* Skip programname and '-K' option */ - argc -= 2; - argv += 2; - exit(krb5_passwd(argc, argv)); -#else - errx(1, "KerberosV support not enabled"); - break; -#endif case 'y': /* change YP password */ #ifdef YP if (!use_yp) { @@ -145,10 +119,6 @@ main(int argc, char **argv) usage(1); } -#if defined(KRB5) - if (use_kerberos) - exit(krb5_passwd(argc, argv)); -#endif #ifdef YP if (force_yp || ((status = local_passwd(username, 0)) && use_yp)) exit(yp_passwd(username)); @@ -161,6 +131,6 @@ main(int argc, char **argv) void usage(int retval) { - fprintf(stderr, "usage: passwd [-K | -l | -y] [user]\n"); + fprintf(stderr, "usage: passwd [-l | -y] [user]\n"); exit(retval); }