auth.c

#include "auth.h"
#include "config.h"

#include <libssh/libssh.h>
#include <libssh/server.h>

#include <stdio.h>
#include <time.h>
#include <string.h>

#define VAL(str) #str

extern int debug;

/* Stores the current UTC time. Returns 0 on error. */
static int get_utc(struct connection *c)
{
    time_t t;
    t = time(NULL);
    return strftime(c->con_time, MAXBUF, "%Y-%m-%d %H:%M:%S", gmtime(&t));
}

/* Write interesting information about a connection attempt to  LOGFILE.
 * Returns -1 on error. */
static int log_attempt(struct connection *c)
{
    FILE *f;
    int r;

    if ((f = fopen(LOGFILE, "a+")) == NULL)
    {
        fprintf(stderr, "Unable to open %s\n", LOGFILE);
        return -1;
    }

    if (get_utc(c) <= 0)
    {
        fprintf(stderr, "Error getting time\n");
        fclose(f);
        return -1;
    }

    c->user = (char*) ssh_message_auth_user(c->message);
    c->pass = (char*) ssh_message_auth_password(c->message);
    if (c->banner == NULL)
        c->banner = "No client ssh banner";

    if (debug)
        printf("%s %s %s %s (%s)\n", c->con_time, c->client_ip, c->user, c->pass, c->banner);

    r = fprintf(f, "# %s (%s)\n%s\t%s\t%s\t%s\n", c->client_ip, c->banner, c->con_time, c->client_ip, c->user, c->pass);
    fclose(f);

    return r;
}


/* Logs password auth attempts. Always replies with SSH_MESSAGE_USERAUTH_FAILURE. */
int handle_auth(ssh_session session, char *client_ip)
{
    unsigned int i, msg, auth_msg;
    struct connection con;
    int timeout = CTIMEOUT;

    con.session = session;
    strcpy(con.client_ip, client_ip);

    ssh_options_set(con.session, SSH_OPTIONS_TIMEOUT, (const void *)&timeout);

    /* Perform key exchange. */
    if (ssh_handle_key_exchange(con.session))
    {
        fprintf(stderr, "Error exchanging keys: `%s'.\n", ssh_get_error(con.session));
        return -1;
    }
    if (debug)
        printf("Successful key exchange.\n");

    con.banner = ssh_get_clientbanner(con.session);

    if (debug && con.banner != NULL)
            printf("Client banner '%s'.\n", con.banner);

    /* only announce password authentication */
    ssh_set_auth_methods(con.session, SSH_AUTH_METHOD_PASSWORD);

    /* Wait for a message, which should be an authentication attempt. Send the default
     * reply if it isn't. Log the attempt and quit. */
    for (i = 0; i < MAX_AUTH_TRIES; )
    {
        if ((con.message = ssh_message_get(con.session)) == NULL)
        {
            if (debug)
                printf("Client %s disconnected (%s).\n", client_ip, ssh_get_error(con.session));

            break;
        }

        msg = ssh_message_type(con.message);
        if (debug && msg != 0x1 && msg != 0x4)
            printf("received message type (0x%02x).\n", ssh_message_type(con.message));

        auth_msg=ssh_message_subtype(con.message);

        switch (auth_msg)
        {
        case SSH_AUTH_METHOD_NONE:
            if (debug)
                printf("Received request %s\n", VAL(SSH_AUTH_METHOD_NONE));

            /* send not supported */
            break;

        case SSH_AUTH_METHOD_PUBLICKEY:
            if (debug)
                printf("Received request %s\n", VAL(SSH_AUTH_METHOD_PUBLICKEY));

            /* send not supported */
            break;

        case SSH_AUTH_METHOD_HOSTBASED:
            if (debug)
                printf("Received request %s\n", VAL(SSH_AUTH_METHOD_HOSTBASED));

            /* send not supported */
            break;

        case SSH_AUTH_METHOD_GSSAPI_MIC:
            if (debug)
                printf("Received request %s\n", VAL(SSH_AUTH_METHOD_GSSAPI_MIC));

            /* send not supported */
            break;

        case SSH_AUTH_METHOD_INTERACTIVE:
            if (debug)
                printf("Received request %s\n", VAL(SSH_AUTH_METHOD_INTERACTIVE));

            /* can we use this for user/pwd/token? */
            break;

        case SSH_AUTH_METHOD_PASSWORD:
            if (debug)
                printf("Received request %s\n", VAL(SSH_AUTH_METHOD_PASSWORD));

            /* Log the authentication request */
            log_attempt(&con);

            break;

        case 0xffffffffu:
            if (msg == 0x4) 
                break;

            if (debug)
                printf("Received request %0x04x %s\n", msg, "0xffffffffu");

            /* don't know why maybe a set of all values enabled? */
            break;

        default:
            if (debug)
                printf("Received unknown request 0x%04x\n", auth_msg);

            /* unknown */
            break;
        }
        /* increase number of auth attempts */
        i++;

        /* Send the default message regardless of the request type. */
        ssh_message_reply_default(con.message);
        ssh_message_free(con.message);
    }
    if (i == MAX_AUTH_TRIES)
    {
        /* send a maxtries reply */
        if (debug)
            printf("Max tries (%d) reached.\n", i);

        /* send the reply */
    }

    if (debug)
        printf("Exiting auth subprocess.\n");

    return 0;
}