Test code showing the problem

pam-tester.c (text/plain), 2.21 KB, created by Tres 'RiverRat' Melton on 2008-04-18 17:27:49 UTC

/*
  This program was contributed by Shane Watts
  [modifications by AGM and kukuk]
  http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/adg-example.html

  You need to add the following (or equivalent) to the
  /etc/pam.d/check_user file:
  # check authorization
  auth       required     pam_unix.so
  account    required     pam_unix.so
 */

#include <security/pam_appl.h>
#include <security/pam_misc.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>

static struct pam_conv conv = {
    misc_conv,
    NULL
};

int main(int argc, char *argv[])
{
    pam_handle_t *pamh=NULL;
    int retval;
    const char *user="nobody";

    char  id_status [160];
    char* pam_user;
    void* pam_ruser;
    void* pam_item;
    int   pam_err;

    if(argc == 2) {
        user = argv[1];
    }

    if(argc > 2) {
        fprintf(stderr, "Usage: check_user [username]\n");
        exit(1);
    }

    retval = pam_start("check_user", user, &conv, &pamh);

    pam_err = pam_get_user( pamh, &pam_user, NULL );
    pam_err = pam_get_item( pamh, PAM_RUSER, &pam_ruser);
    sprintf( id_status, "UID:%d  EUID:%d  GID:%d  EGID:%d  PAM_user:%s  PAM_ruser:%s", getuid(), geteuid(), getgid(), getegid(), pam_user, pam_ruser );
    //  http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/adg-interface-by-app-expected.html#adg-pam_get_item
    //  pam_get_item( pamh, PAM_???, &pam_item);
    //  PAM_SERVICE PAM_USER PAM_USER_PROMPT PAM_TTY PAM_RUSER PAM_RHOST PAM_AUTHTOK PAM_OLDAUTHTOK PAM_CONV PAM_FAIL_DELAY PAM_XDISPLAY PAM_XAUTHDATA 

    if (retval == PAM_SUCCESS)
        retval = pam_authenticate(pamh, 0);    /* is user really user? */

    if (retval == PAM_SUCCESS)
        retval = pam_acct_mgmt(pamh, 0);       /* permitted access? */

    /* This is where we have been authorized or not. */

    if (retval == PAM_SUCCESS) {
        fprintf(stdout, "    Authenticated. %s\n", id_status );
    } else {
        fprintf(stdout, "Not Authenticated. %s\n", id_status );
    }

    if (pam_end(pamh,retval) != PAM_SUCCESS) {     /* close Linux-PAM */
        pamh = NULL;
        fprintf(stderr, "check_user: failed to release authenticator\n");
        exit(1);
    }

    return ( retval == PAM_SUCCESS ? 0:1 );       /* indicate success */
}