PATCH: HPUX trusted system password checking

[Kevin Steves]

On Mon, 11 Sep 2000, Dirk De Wachter wrote:
: I don't like to use PAM since it was only introduced for DCE (which I 
: don't use) and is greatly unsupported for HPUX 10.20. I have never 
: tried to make it work for other programs. Moreover if PAM is not 
: installed but the HPUX-trusted password change is, we will still need 
: to support it, I guess. Others might have different views though. 
: I like your suggestion of using iscomsec to differentiate between a 
: trusted/regular system, as this will allow to have the same binary 
: shared over NFS by different systems.

Attached is a patch which removes the HAVE_HPUX_TRUSTED_SYSTEM_PW
define, and instead uses __hpux to determine if we're HP-UX and
iscomsec(2) to determine if commercial security/trusted system is
enabled.  I have only tested this on HP-UX 11.0 (with --without-pam),
but I think it should work on 10.20.

Note that because I define DISABLE_SHADOW the password age check in
auth.c that I *think* was getting executed on HP-UX is no longer
included.  There should probably be an || __hpux to keep that.  The
password aging support needs work for non-trusted, trusted/shadow and
PAM.  I'm not sure how best to handle that right now.
-------------- next part --------------
--- openssh/configure.in	Tue Sep  5 07:13:07 2000
+++ openssh-ks/configure.in	Tue Sep 12 13:00:50 2000
@@ -73,16 +73,8 @@
 	CFLAGS="$CFLAGS -D_HPUX_SOURCE"
 	IPADDR_IN_DISPLAY=yes
 	AC_DEFINE(USE_PIPES)
-	AC_MSG_CHECKING(for HPUX trusted system password database)
-	if test -f /tcb/files/auth/system/default; then
-		AC_MSG_RESULT(yes)
-		AC_DEFINE(HAVE_HPUX_TRUSTED_SYSTEM_PW)
-		LIBS="$LIBS -lsec"
-		AC_MSG_WARN([This configuration is untested])
-	else
-		AC_MSG_RESULT(no)
-		AC_DEFINE(DISABLE_SHADOW)
-	fi
+	AC_DEFINE(DISABLE_SHADOW)
+	LIBS="$LIBS -lsec"
 	MANTYPE='$(CATMAN)'
 	mansubdir=cat
 	;;
@@ -90,16 +82,8 @@
 	CFLAGS="$CFLAGS -D_HPUX_SOURCE"
 	IPADDR_IN_DISPLAY=yes
 	AC_DEFINE(USE_PIPES)
-	AC_MSG_CHECKING(for HPUX trusted system password database)
-	if test -f /tcb/files/auth/system/default; then
-		AC_MSG_RESULT(yes)
-		AC_DEFINE(HAVE_HPUX_TRUSTED_SYSTEM_PW)
-		LIBS="$LIBS -lsec"
-		AC_MSG_WARN([This configuration is untested])
-	else
-		AC_MSG_RESULT(no)
-		AC_DEFINE(DISABLE_SHADOW)
-	fi
+	AC_DEFINE(DISABLE_SHADOW)
+	LIBS="$LIBS -lsec"
 	MANTYPE='$(CATMAN)'
 	mansubdir=cat
 	;;
--- openssh/acconfig.h	Tue Sep  5 07:13:07 2000
+++ openssh-ks/acconfig.h	Tue Sep 12 13:43:14 2000
@@ -186,9 +186,6 @@
 /* Define if you want to use shadow password expire field */
 #undef HAS_SHADOW_EXPIRE
 
-/* Define if you want have trusted HPUX */
-#undef HAVE_HPUX_TRUSTED_SYSTEM_PW
-
 /* Define if you have Digital Unix Security Integration Architecture */
 #undef HAVE_OSF_SIA
 
--- openssh/auth-passwd.c	Tue Sep  5 07:13:07 2000
+++ openssh-ks/auth-passwd.c	Tue Sep 12 13:59:31 2000
@@ -21,14 +21,14 @@
 #ifdef WITH_AIXAUTHENTICATE
 # include <login.h>
 #endif
-#ifdef HAVE_HPUX_TRUSTED_SYSTEM_PW
+#ifdef __hpux
 # include <hpsecurity.h>
 # include <prot.h>
 #endif
-#ifdef HAVE_SHADOW_H
+#if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
 # include <shadow.h>
 #endif
-#ifdef HAVE_GETPWANAM
+#if defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW)
 # include <sys/label.h>
 # include <sys/audit.h>
 # include <pwdadj.h>
@@ -55,10 +55,13 @@
 	char *encrypted_password;
 	char *pw_password;
 	char *salt;
-#ifdef HAVE_SHADOW_H
+#ifdef __hpux
+	struct pr_passwd *spw;
+#endif
+#if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
 	struct spwd *spw;
 #endif
-#ifdef HAVE_GETPWANAM
+#if defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW)
 	struct passwd_adjunct *spw;
 #endif
 #ifdef WITH_AIXAUTHENTICATE
@@ -117,34 +120,29 @@
 	}
 #endif
 
-	/* Check for users with no password. */
-	if (strcmp(password, "") == 0 && strcmp(pw->pw_passwd, "") == 0)
-		return 1;
-
 	pw_password = pw->pw_passwd;
 
+	/* Various interfaces to shadow or protected password data */
 #if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
 	spw = getspnam(pw->pw_name);
 	if (spw != NULL) 
-	{
-		/* Check for users with no password. */
-		if (strcmp(password, "") == 0 && strcmp(spw->sp_pwdp, "") == 0)
-			return 1;
-
 		pw_password = spw->sp_pwdp;
-	}
 #endif /* defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) */
+
 #if defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW)
 	if (issecure() && (spw = getpwanam(pw->pw_name)) != NULL)
-	{
-		/* Check for users with no password. */
-		if (strcmp(password, "") == 0 && strcmp(spw->pwa_passwd, "") == 0)
-			return 1;
-
 		pw_password = spw->pwa_passwd;
-	}
 #endif /* defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW) */
 
+#ifdef __hpux
+	if (iscomsec() && (spw = getprpwnam(pw->pw_name)) != NULL)
+		pw_password = spw->ufld.fd_encrypt;
+#endif
+
+	/* Check for users with no password. */
+	if (strcmp(password, "") == 0 && strcmp(pw_password, "") == 0)
+		return 1;
+
 	if (pw_password[0] != '\0')
 		salt = pw_password;
 	else
@@ -156,11 +154,14 @@
 	else
 		encrypted_password = crypt(password, salt);
 #else /* HAVE_MD5_PASSWORDS */    
-# ifdef HAVE_HPUX_TRUSTED_SYSTEM_PW
-	encrypted_password = bigcrypt(password, salt);
+# ifdef __hpux
+	if (iscomsec())
+		encrypted_password = bigcrypt(password, salt);
+	else
+		encrypted_password = crypt(password, salt);
 # else
 	encrypted_password = crypt(password, salt);
-# endif /* HAVE_HPUX_TRUSTED_SYSTEM_PW */
+# endif /* __hpux */
 #endif /* HAVE_MD5_PASSWORDS */    
 
 	/* Authentication is accepted if the encrypted passwords are identical. */