logo标签列表

用C语言编写自定义PAM模块以支持SSHD

clinuxubuntusshpam
4

我正在尝试创建一个SSH后门来了解PAM的工作原理。参考这个例子：https://github.com/beatgammit/simple-pam，我已经知道如何创建一个功能性的PAM模块，但我想从CIN中读取一个硬编码的令牌。我尝试了以下内容：

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <security/pam_appl.h>
#include <security/pam_modules.h>

/* expected hook */
PAM_EXTERN int pam_sm_setcred( pam_handle_t *pamh, int flags, int argc, const char **argv ) {
    return PAM_SUCCESS;
}

PAM_EXTERN int pam_sm_acct_mgmt(pam_handle_t *pamh, int flags, int argc, const char **argv) {
    printf("Acct mgmt\n");
    return PAM_SUCCESS;
}

/* expected hook, this is where custom stuff happens */
PAM_EXTERN int pam_sm_authenticate( pam_handle_t *pamh, int flags,int argc, const char **argv ) {
    int retval;

    const char* pUsername;
    retval = pam_get_user(pamh, &pUsername, "Username: ");

    printf("Welcome %s\n", pUsername);

    if (retval != PAM_SUCCESS) {
        return retval;
    }

    if (strcmp(pUsername, "luciannitescu") != 0) {
        return PAM_AUTH_ERR;
    }

    char securetoken[8] = "aaaaaaa";
    char password[8];
    printf("Enter your secure token:\n");
    scanf(password);

    if (strcmp(password, securetoken) != 0)
    {
        return PAM_AUTH_ERR;
    }
    return PAM_SUCCESS;
}

在进行ssh身份验证时，我收到了权限被拒绝的消息，如果我删除以下代码行，一切都可以正常工作：

char securetoken[8] = "aaaaaaa";
    char password[8];
    printf("Enter your secure token:\n");
    scanf(password);

    if (strcmp(password, securetoken) != 0)
    {
        return PAM_AUTH_ERR;
    }

认证失败：

ssh luciannitescu@127.0.0.1 -v
OpenSSH_7.6p1 Ubuntu-4, OpenSSL 1.0.2n  7 Dec 2017
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to 127.0.0.1 [127.0.0.1] port 22.
debug1: Connection established.
debug1: identity file /home/lucian/.ssh/id_rsa type 0
debug1: key_load_public: No such file or directory
debug1: identity file /home/lucian/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/lucian/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/lucian/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/lucian/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/lucian/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/lucian/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/lucian/.ssh/id_ed25519-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.6p1 Ubuntu-4
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.2p2 Ubuntu-4ubuntu2.4
debug1: match: OpenSSH_7.2p2 Ubuntu-4ubuntu2.4 pat OpenSSH* compat 0x04000000
debug1: Authenticating to 127.0.0.1:22 as 'luciannitescu'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256@libssh.org
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:...
debug1: Host '127.0.0.1' is known and matches the ECDSA host key.
debug1: Found key in /home/lucian/.ssh/known_hosts:22
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering public key: RSA SHA256:... /home/lucian/.ssh/id_rsa
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /home/lucian/.ssh/id_dsa
debug1: Trying private key: /home/lucian/.ssh/id_ecdsa
debug1: Trying private key: /home/lucian/.ssh/id_ed25519
debug1: Next authentication method: password
luciannitescu@127.0.0.1's password: 
debug1: Authentications that can continue: publickey,password
Permission denied, please try again.
luciannitescu@127.0.0.1's password: 
debug1: Authentications that can continue: publickey,password
Permission denied, please try again.
luciannitescu@127.0.0.1's password: 
debug1: Authentications that can continue: publickey,password
debug1: No more authentication methods to try.
luciannitescu@127.0.0.1: Permission denied (publickey,password).

后续编辑：

对代码进行以下更改：

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <security/pam_appl.h>
#include <security/pam_modules.h>

/* expected hook */
PAM_EXTERN int pam_sm_setcred( pam_handle_t *pamh, int flags, int argc, const char **argv ) {
    return PAM_SUCCESS;
}

PAM_EXTERN int pam_sm_acct_mgmt(pam_handle_t *pamh, int flags, int argc, const char **argv) {
    printf("Acct mgmt\n");

    return PAM_SUCCESS;
}

/* expected hook, this is where custom stuff happens */
PAM_EXTERN int pam_sm_authenticate( pam_handle_t *pamh, int flags,int argc, const char **argv ) {
    struct pam_message msg[1];
    struct pam_response *resp = NULL;
    struct pam_conv *conv;

    pam_get_item (pamh, PAM_CONV, (const void **) &conv);
    msg[0].msg = "Enter your secret token: ";
    msg[0].msg_style = PAM_PROMPT_ECHO_OFF;
    conv->conv(1, &msg, &resp, conv->appdata_ptr);
    // Token is now in resp->resp;

    int retval;

    const char* pUsername;
    retval = pam_get_user(pamh, &pUsername, "Username: ");

    printf("Welcome %s\n", pUsername);

    if (retval != PAM_SUCCESS) {
        return retval;
    }

    if (strcmp(pUsername, "luciannitescu") != 0) {
        return PAM_AUTH_ERR;
    }



    return PAM_SUCCESS;
}

我无法建立SSH连接：

lucian@local:~$ ssh luciannitescu@127.0.0.1
luciannitescu@127.0.0.1's password: 
Connection closed by 127.0.0.1 port 22

服务器调试：

debug3: mm_request_send entering: type 23
debug2: userauth_pubkey: authenticated 0 pkalg rsa-sha2-512 [preauth]
debug3: userauth_finish: failure partial=0 next methods="publickey,password" [preauth]
debug3: send packet: type 51 [preauth]
debug3: receive packet: type 50 [preauth]
debug1: userauth-request for user luciannitescu service ssh-connection method password [preauth]
debug1: attempt 2 failures 1 [preauth]
debug2: input_userauth_request: try method password [preauth]
debug3: mm_auth_password entering [preauth]
debug3: mm_request_send entering: type 12 [preauth]
debug3: mm_auth_password: waiting for MONITOR_ANS_AUTHPASSWORD [preauth]
debug3: mm_request_receive_expect entering: type 13 [preauth]
debug3: mm_request_receive entering [preauth]
debug3: mm_request_receive entering
debug3: monitor_read: checking request 12
debug3: PAM: sshpam_passwd_conv called with 1 messages
mm_log_handler: write: Broken pipe
debug1: do_cleanup
debug3: PAM: sshpam_thread_cleanup entering
Segmentation fault (core dumped)
1个回答
2

你不能使用scanf()从用户那里读取值，因为stdin不会传递给用户。你必须使用带有适当函数的ssh键盘交互身份验证。这由pam_conv（PAM对话）函数支持。

_man 3 pam_conv_手册描述了接口。它基本上是这样工作的：

PAM_EXTERN int
pam_sm_authenticate (pam_handle_t * pamh,
                 int flags, int argc, const char **argv)
{
    struct pam_message msg[1];
    struct pam_response *resp = NULL;
    struct pam_conv *conv;

    pam_get_item (pamh, PAM_CONV, (const void **) &conv);
    msg[0].msg = "Enter your secret token: ";
    msg[0].msg_style = PAM_PROMPT_ECHO_OFF;
    conv->conv(1, &msg, &resp, conv->appdata_ptr);
    // Token is now in resp->resp;
    ....
}

你可以将此作为自定义身份验证功能的起点。
为什么我在22端口上收到连接关闭的消息？ - Nitescu Lucian
@NitescuLucian 如果您有其他问题，请在问题中详细描述它们。 - Ctx
@NitescuLucian 1) 总是进行错误检查（pam_get_item()/ conv->conv()）等。为了简洁起见，我已省略了这部分。此外，您可以使用sshd -dddDp 222启动服务器并连接到端口222，看看在服务器端会发生什么。 - Ctx
你能帮我吗？ - Nitescu Lucian
网页内容由stack overflow 提供, 点击上面的
可以查看英文原文，
原文链接