svr-auth.c - third_party/dropbear - Git at Google

 /*
  * Dropbear - a SSH2 server
  *
  * Copyright (c) 2002,2003 Matt Johnston
  * All rights reserved.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
  * in the Software without restriction, including without limitation the rights
  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  * copies of the Software, and to permit persons to whom the Software is
  * furnished to do so, subject to the following conditions:
  *
  * The above copyright notice and this permission notice shall be included in
  * all copies or substantial portions of the Software.
  *
  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
  * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE. */

 /* This file (auth.c) handles authentication requests, passing it to the
  * particular type (auth-passwd, auth-pubkey). */

 #include "includes.h"
 #include "dbutil.h"
 #include "session.h"
 #include "buffer.h"
 #include "ssh.h"
 #include "packet.h"
 #include "auth.h"
 #include "runopts.h"
 #include "dbrandom.h"

 static void authclear();
 static int checkusername(char *username, unsigned int userlen);

 /* initialise the first time for a session, resetting all parameters */
 void svr_authinitialise() {

 	ses.authstate.failcount = 0;
 	ses.authstate.pw_name = NULL;
 	ses.authstate.pw_dir = NULL;
 	ses.authstate.pw_shell = NULL;
 	ses.authstate.pw_passwd = NULL;
 	authclear();

 }

 /* Reset the auth state, but don't reset the failcount. This is for if the
  * user decides to try with a different username etc, and is also invoked
  * on initialisation */
 static void authclear() {

 	memset(&ses.authstate, 0, sizeof(ses.authstate));
 #ifdef ENABLE_SVR_PUBKEY_AUTH
 	ses.authstate.authtypes |= AUTH_TYPE_PUBKEY;
 #endif
 #if defined(ENABLE_SVR_PASSWORD_AUTH) || defined(ENABLE_SVR_PAM_AUTH)
 	if (!svr_opts.noauthpass) {
 		ses.authstate.authtypes |= AUTH_TYPE_PASSWORD;
 	}
 #endif
 	if (ses.authstate.pw_name) {
 		m_free(ses.authstate.pw_name);
 	}
 	if (ses.authstate.pw_shell) {
 		m_free(ses.authstate.pw_shell);
 	}
 	if (ses.authstate.pw_dir) {
 		m_free(ses.authstate.pw_dir);
 	}
 	if (ses.authstate.pw_passwd) {
 		m_free(ses.authstate.pw_passwd);
 	}

 }

 /* Send a banner message if specified to the client. The client might
  * ignore this, but possibly serves as a legal "no trespassing" sign */
 void send_msg_userauth_banner(buffer *banner) {

 	TRACE(("enter send_msg_userauth_banner"))

 	CHECKCLEARTOWRITE();

 	buf_putbyte(ses.writepayload, SSH_MSG_USERAUTH_BANNER);
 	buf_putbufstring(ses.writepayload, banner);
 	buf_putstring(ses.writepayload, "en", 2);

 	encrypt_packet();

 	TRACE(("leave send_msg_userauth_banner"))
 }

 /* handle a userauth request, check validity, pass to password or pubkey
  * checking, and handle success or failure */
 void recv_msg_userauth_request() {

 	char *username = NULL, *servicename = NULL, *methodname = NULL;
 	unsigned int userlen, servicelen, methodlen;
 	int valid_user = 0;

 	TRACE(("enter recv_msg_userauth_request"))

 	/* ignore packets if auth is already done */
 	if (ses.authstate.authdone == 1) {
 		TRACE(("leave recv_msg_userauth_request: authdone already"))
 		return;
 	}

 	/* send the banner if it exists, it will only exist once */
 	if (svr_opts.banner) {
 		send_msg_userauth_banner(svr_opts.banner);
 		buf_free(svr_opts.banner);
 		svr_opts.banner = NULL;
 	}

 	username = buf_getstring(ses.payload, &userlen);
 	servicename = buf_getstring(ses.payload, &servicelen);
 	methodname = buf_getstring(ses.payload, &methodlen);

 	/* only handle 'ssh-connection' currently */
 	if (servicelen != SSH_SERVICE_CONNECTION_LEN
 			&& (strncmp(servicename, SSH_SERVICE_CONNECTION,
 					SSH_SERVICE_CONNECTION_LEN) != 0)) {

 		/* TODO - disconnect here */
 		m_free(username);
 		m_free(servicename);
 		m_free(methodname);
 		dropbear_exit("unknown service in auth");
 	}

 	/* check username is good before continuing.
 	 * the 'incrfail' varies depending on the auth method to
 	 * avoid giving away which users exist on the system through
 	 * the time delay. */
 	if (checkusername(username, userlen) == DROPBEAR_SUCCESS) {
 		valid_user = 1;
 	}

 	/* user wants to know what methods are supported */
 	if (methodlen == AUTH_METHOD_NONE_LEN &&
 			strncmp(methodname, AUTH_METHOD_NONE,
 				AUTH_METHOD_NONE_LEN) == 0) {
 		TRACE(("recv_msg_userauth_request: 'none' request"))
 		if (valid_user
 				&& svr_opts.allowblankpass
 				&& !svr_opts.noauthpass
 				&& !(svr_opts.norootpass && ses.authstate.pw_uid == 0)
 				&& ses.authstate.pw_passwd[0] == '\0')
 		{
 			dropbear_log(LOG_NOTICE,
 					"Auth succeeded with blank password for '%s' from %s",
 					ses.authstate.pw_name,
 					svr_ses.addrstring);
 			send_msg_userauth_success();
 			goto out;
 		}
 		else
 		{
 			/* 'none' has no failure delay */
 			send_msg_userauth_failure(0, 0);
 			goto out;
 		}
 	}

 #ifdef ENABLE_SVR_PASSWORD_AUTH
 	if (!svr_opts.noauthpass &&
 			!(svr_opts.norootpass && ses.authstate.pw_uid == 0) ) {
 		/* user wants to try password auth */
 		if (methodlen == AUTH_METHOD_PASSWORD_LEN &&
 				strncmp(methodname, AUTH_METHOD_PASSWORD,
 					AUTH_METHOD_PASSWORD_LEN) == 0) {
 			if (valid_user) {
 				svr_auth_password();
 				goto out;
 			}
 		}
 	}
 #endif

 #ifdef ENABLE_SVR_PAM_AUTH
 	if (!svr_opts.noauthpass &&
 			!(svr_opts.norootpass && ses.authstate.pw_uid == 0) ) {
 		/* user wants to try password auth */
 		if (methodlen == AUTH_METHOD_PASSWORD_LEN &&
 				strncmp(methodname, AUTH_METHOD_PASSWORD,
 					AUTH_METHOD_PASSWORD_LEN) == 0) {
 			if (valid_user) {
 				svr_auth_pam();
 				goto out;
 			}
 		}
 	}
 #endif

 #ifdef ENABLE_SVR_PUBKEY_AUTH
 	/* user wants to try pubkey auth */
 	if (methodlen == AUTH_METHOD_PUBKEY_LEN &&
 			strncmp(methodname, AUTH_METHOD_PUBKEY,
 				AUTH_METHOD_PUBKEY_LEN) == 0) {
 		if (valid_user) {
 			svr_auth_pubkey();
 		} else {
 			/* pubkey has no failure delay */
 			send_msg_userauth_failure(0, 0);
 		}
 		goto out;
 	}
 #endif

 	/* nothing matched, we just fail with a delay */
 	send_msg_userauth_failure(0, 1);

 out:

 	m_free(username);
 	m_free(servicename);
 	m_free(methodname);
 }


 /* Check that the username exists and isn't disallowed (root), and has a valid shell.
  * returns DROPBEAR_SUCCESS on valid username, DROPBEAR_FAILURE on failure */
 static int checkusername(char *username, unsigned int userlen) {

 	char* listshell = NULL;
 	char* usershell = NULL;
 	uid_t uid;
 	TRACE(("enter checkusername"))
 	if (userlen > MAX_USERNAME_LEN) {
 		return DROPBEAR_FAILURE;
 	}

 	/* new user or username has changed */
 	if (ses.authstate.username == NULL ||
 		strcmp(username, ses.authstate.username) != 0) {
 			/* the username needs resetting */
 			if (ses.authstate.username != NULL) {
 				dropbear_log(LOG_WARNING, "Client trying multiple usernames from %s",
 							svr_ses.addrstring);
 				m_free(ses.authstate.username);
 			}
 			authclear();
 			fill_passwd(username);
 			ses.authstate.username = m_strdup(username);
 	}

 	/* check that user exists */
 	if (!ses.authstate.pw_name) {
 		TRACE(("leave checkusername: user '%s' doesn't exist", username))
 		dropbear_log(LOG_WARNING,
 				"Login attempt for nonexistent user from %s",
 				svr_ses.addrstring);
 		return DROPBEAR_FAILURE;
 	}

 	/* check if we are running as non-root, and login user is different from the server */
 	uid = geteuid();
 	if (uid != 0 && uid != ses.authstate.pw_uid) {
 		TRACE(("running as nonroot, only server uid is allowed"))
 		dropbear_log(LOG_WARNING,
 				"Login attempt with wrong user %s from %s",
 				ses.authstate.pw_name,
 				svr_ses.addrstring);
 		return DROPBEAR_FAILURE;
 	}

 	/* check for non-root if desired */
 	if (svr_opts.norootlogin && ses.authstate.pw_uid == 0) {
 		TRACE(("leave checkusername: root login disabled"))
 		dropbear_log(LOG_WARNING, "root login rejected");
 		return DROPBEAR_FAILURE;
 	}

 	TRACE(("shell is %s", ses.authstate.pw_shell))

 	/* check that the shell is set */
 	usershell = ses.authstate.pw_shell;
 	if (usershell[0] == '\0') {
 		/* empty shell in /etc/passwd means /bin/sh according to passwd(5) */
 		usershell = "/bin/sh";
 	}

 	/* check the shell is valid. If /etc/shells doesn't exist, getusershell()
 	 * should return some standard shells like "/bin/sh" and "/bin/csh" (this
 	 * is platform-specific) */
 	setusershell();
 	while ((listshell = getusershell()) != NULL) {
 		TRACE(("test shell is '%s'", listshell))
 		if (strcmp(listshell, usershell) == 0) {
 			/* have a match */
 			goto goodshell;
 		}
 	}
 	/* no matching shell */
 	endusershell();
 	TRACE(("no matching shell"))
 	dropbear_log(LOG_WARNING, "User '%s' has invalid shell, rejected",
 				ses.authstate.pw_name);
 	return DROPBEAR_FAILURE;

 goodshell:
 	endusershell();
 	TRACE(("matching shell"))

 	TRACE(("uid = %d", ses.authstate.pw_uid))
 	TRACE(("leave checkusername"))
 	return DROPBEAR_SUCCESS;
 }

 /* Send a failure message to the client, in responds to a userauth_request.
  * Partial indicates whether to set the "partial success" flag,
  * incrfail is whether to count this failure in the failure count (which
  * is limited. This function also handles disconnection after too many
  * failures */
 void send_msg_userauth_failure(int partial, int incrfail) {

 	buffer *typebuf = NULL;

 	TRACE(("enter send_msg_userauth_failure"))

 	CHECKCLEARTOWRITE();

 	buf_putbyte(ses.writepayload, SSH_MSG_USERAUTH_FAILURE);

 	/* put a list of allowed types */
 	typebuf = buf_new(30); /* long enough for PUBKEY and PASSWORD */

 	if (ses.authstate.authtypes & AUTH_TYPE_PUBKEY) {
 		buf_putbytes(typebuf, (const unsigned char *)AUTH_METHOD_PUBKEY, AUTH_METHOD_PUBKEY_LEN);
 		if (ses.authstate.authtypes & AUTH_TYPE_PASSWORD) {
 			buf_putbyte(typebuf, ',');
 		}
 	}

 	if (ses.authstate.authtypes & AUTH_TYPE_PASSWORD) {
 		buf_putbytes(typebuf, (const unsigned char *)AUTH_METHOD_PASSWORD, AUTH_METHOD_PASSWORD_LEN);
 	}

 	buf_putbufstring(ses.writepayload, typebuf);

 	TRACE(("auth fail: methods %d, '%.*s'", ses.authstate.authtypes,
 				typebuf->len, typebuf->data))

 	buf_free(typebuf);

 	buf_putbyte(ses.writepayload, partial ? 1 : 0);
 	encrypt_packet();

 	if (incrfail) {
 		unsigned int delay;
 		genrandom((unsigned char*)&delay, sizeof(delay));
 		/* We delay for 300ms +- 50ms */
 		delay = 250000 + (delay % 100000);
 		usleep(delay);
 		ses.authstate.failcount++;
 	}

 	if (ses.authstate.failcount >= MAX_AUTH_TRIES) {
 		char * userstr;
 		/* XXX - send disconnect ? */
 		TRACE(("Max auth tries reached, exiting"))

 		if (ses.authstate.pw_name == NULL) {
 			userstr = "is invalid";
 		} else {
 			userstr = ses.authstate.pw_name;
 		}
 		dropbear_exit("Max auth tries reached - user '%s' from %s",
 				userstr, svr_ses.addrstring);
 	}

 	TRACE(("leave send_msg_userauth_failure"))
 }

 /* Send a success message to the user, and set the "authdone" flag */
 void send_msg_userauth_success() {

 	TRACE(("enter send_msg_userauth_success"))

 	CHECKCLEARTOWRITE();

 	buf_putbyte(ses.writepayload, SSH_MSG_USERAUTH_SUCCESS);
 	encrypt_packet();

 	/* authdone must be set after encrypt_packet() for
 	 * delayed-zlib mode */
 	ses.authstate.authdone = 1;
 	ses.connect_time = 0;


 	if (ses.authstate.pw_uid == 0) {
 		ses.allowprivport = 1;
 	}

 	/* Remove from the list of pre-auth sockets. Should be m_close(), since if
 	 * we fail, we might end up leaking connection slots, and disallow new
 	 * logins - a nasty situation. */
 	m_close(svr_ses.childpipe);

 	TRACE(("leave send_msg_userauth_success"))

 }
	/*
	* Dropbear - a SSH2 server
	*
	* Copyright (c) 2002,2003 Matt Johnston
	* All rights reserved.
	*
	* Permission is hereby granted, free of charge, to any person obtaining a copy
	* of this software and associated documentation files (the "Software"), to deal
	* in the Software without restriction, including without limitation the rights
	* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
	* copies of the Software, and to permit persons to whom the Software is
	* furnished to do so, subject to the following conditions:
	*
	* The above copyright notice and this permission notice shall be included in
	* all copies or substantial portions of the Software.
	*
	* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
	* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
	* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
	* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
	* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
	* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
	* SOFTWARE. */

	/* This file (auth.c) handles authentication requests, passing it to the
	* particular type (auth-passwd, auth-pubkey). */

	#include "includes.h"
	#include "dbutil.h"
	#include "session.h"
	#include "buffer.h"
	#include "ssh.h"
	#include "packet.h"
	#include "auth.h"
	#include "runopts.h"
	#include "dbrandom.h"

	static void authclear();
	static int checkusername(char *username, unsigned int userlen);

	/* initialise the first time for a session, resetting all parameters */
	void svr_authinitialise() {

	ses.authstate.failcount = 0;
	ses.authstate.pw_name = NULL;
	ses.authstate.pw_dir = NULL;
	ses.authstate.pw_shell = NULL;
	ses.authstate.pw_passwd = NULL;
	authclear();

	}

	/* Reset the auth state, but don't reset the failcount. This is for if the
	* user decides to try with a different username etc, and is also invoked
	* on initialisation */
	static void authclear() {

	memset(&ses.authstate, 0, sizeof(ses.authstate));
	#ifdef ENABLE_SVR_PUBKEY_AUTH
	ses.authstate.authtypes \|= AUTH_TYPE_PUBKEY;
	#endif
	#if defined(ENABLE_SVR_PASSWORD_AUTH) \|\| defined(ENABLE_SVR_PAM_AUTH)
	if (!svr_opts.noauthpass) {
	ses.authstate.authtypes \|= AUTH_TYPE_PASSWORD;
	}
	#endif
	if (ses.authstate.pw_name) {
	m_free(ses.authstate.pw_name);
	}
	if (ses.authstate.pw_shell) {
	m_free(ses.authstate.pw_shell);
	}
	if (ses.authstate.pw_dir) {
	m_free(ses.authstate.pw_dir);
	}
	if (ses.authstate.pw_passwd) {
	m_free(ses.authstate.pw_passwd);
	}

	}

	/* Send a banner message if specified to the client. The client might
	* ignore this, but possibly serves as a legal "no trespassing" sign */
	void send_msg_userauth_banner(buffer *banner) {

	TRACE(("enter send_msg_userauth_banner"))

	CHECKCLEARTOWRITE();

	buf_putbyte(ses.writepayload, SSH_MSG_USERAUTH_BANNER);
	buf_putbufstring(ses.writepayload, banner);
	buf_putstring(ses.writepayload, "en", 2);

	encrypt_packet();

	TRACE(("leave send_msg_userauth_banner"))
	}

	/* handle a userauth request, check validity, pass to password or pubkey
	* checking, and handle success or failure */
	void recv_msg_userauth_request() {

	char username = NULL, servicename = NULL, *methodname = NULL;
	unsigned int userlen, servicelen, methodlen;
	int valid_user = 0;

	TRACE(("enter recv_msg_userauth_request"))

	/* ignore packets if auth is already done */
	if (ses.authstate.authdone == 1) {
	TRACE(("leave recv_msg_userauth_request: authdone already"))
	return;
	}

	/* send the banner if it exists, it will only exist once */
	if (svr_opts.banner) {
	send_msg_userauth_banner(svr_opts.banner);
	buf_free(svr_opts.banner);
	svr_opts.banner = NULL;
	}

	username = buf_getstring(ses.payload, &userlen);
	servicename = buf_getstring(ses.payload, &servicelen);
	methodname = buf_getstring(ses.payload, &methodlen);

	/* only handle 'ssh-connection' currently */
	if (servicelen != SSH_SERVICE_CONNECTION_LEN
	&& (strncmp(servicename, SSH_SERVICE_CONNECTION,
	SSH_SERVICE_CONNECTION_LEN) != 0)) {

	/* TODO - disconnect here */
	m_free(username);
	m_free(servicename);
	m_free(methodname);
	dropbear_exit("unknown service in auth");
	}

	/* check username is good before continuing.
	* the 'incrfail' varies depending on the auth method to
	* avoid giving away which users exist on the system through
	* the time delay. */
	if (checkusername(username, userlen) == DROPBEAR_SUCCESS) {
	valid_user = 1;
	}

	/* user wants to know what methods are supported */
	if (methodlen == AUTH_METHOD_NONE_LEN &&
	strncmp(methodname, AUTH_METHOD_NONE,
	AUTH_METHOD_NONE_LEN) == 0) {
	TRACE(("recv_msg_userauth_request: 'none' request"))
	if (valid_user
	&& svr_opts.allowblankpass
	&& !svr_opts.noauthpass
	&& !(svr_opts.norootpass && ses.authstate.pw_uid == 0)
	&& ses.authstate.pw_passwd[0] == '\0')
	{
	dropbear_log(LOG_NOTICE,
	"Auth succeeded with blank password for '%s' from %s",
	ses.authstate.pw_name,
	svr_ses.addrstring);
	send_msg_userauth_success();
	goto out;
	}
	else
	{
	/* 'none' has no failure delay */
	send_msg_userauth_failure(0, 0);
	goto out;
	}
	}

	#ifdef ENABLE_SVR_PASSWORD_AUTH
	if (!svr_opts.noauthpass &&
	!(svr_opts.norootpass && ses.authstate.pw_uid == 0) ) {
	/* user wants to try password auth */
	if (methodlen == AUTH_METHOD_PASSWORD_LEN &&
	strncmp(methodname, AUTH_METHOD_PASSWORD,
	AUTH_METHOD_PASSWORD_LEN) == 0) {
	if (valid_user) {
	svr_auth_password();
	goto out;
	}
	}
	}
	#endif

	#ifdef ENABLE_SVR_PAM_AUTH
	if (!svr_opts.noauthpass &&
	!(svr_opts.norootpass && ses.authstate.pw_uid == 0) ) {
	/* user wants to try password auth */
	if (methodlen == AUTH_METHOD_PASSWORD_LEN &&
	strncmp(methodname, AUTH_METHOD_PASSWORD,
	AUTH_METHOD_PASSWORD_LEN) == 0) {
	if (valid_user) {
	svr_auth_pam();
	goto out;
	}
	}
	}
	#endif

	#ifdef ENABLE_SVR_PUBKEY_AUTH
	/* user wants to try pubkey auth */
	if (methodlen == AUTH_METHOD_PUBKEY_LEN &&
	strncmp(methodname, AUTH_METHOD_PUBKEY,
	AUTH_METHOD_PUBKEY_LEN) == 0) {
	if (valid_user) {
	svr_auth_pubkey();
	} else {
	/* pubkey has no failure delay */
	send_msg_userauth_failure(0, 0);
	}
	goto out;
	}
	#endif

	/* nothing matched, we just fail with a delay */
	send_msg_userauth_failure(0, 1);

	out:

	m_free(username);
	m_free(servicename);
	m_free(methodname);
	}


	/* Check that the username exists and isn't disallowed (root), and has a valid shell.
	* returns DROPBEAR_SUCCESS on valid username, DROPBEAR_FAILURE on failure */
	static int checkusername(char *username, unsigned int userlen) {

	char* listshell = NULL;
	char* usershell = NULL;
	uid_t uid;
	TRACE(("enter checkusername"))
	if (userlen > MAX_USERNAME_LEN) {
	return DROPBEAR_FAILURE;
	}

	/* new user or username has changed */
	if (ses.authstate.username == NULL \|\|
	strcmp(username, ses.authstate.username) != 0) {
	/* the username needs resetting */
	if (ses.authstate.username != NULL) {
	dropbear_log(LOG_WARNING, "Client trying multiple usernames from %s",
	svr_ses.addrstring);
	m_free(ses.authstate.username);
	}
	authclear();
	fill_passwd(username);
	ses.authstate.username = m_strdup(username);
	}

	/* check that user exists */
	if (!ses.authstate.pw_name) {
	TRACE(("leave checkusername: user '%s' doesn't exist", username))
	dropbear_log(LOG_WARNING,
	"Login attempt for nonexistent user from %s",
	svr_ses.addrstring);
	return DROPBEAR_FAILURE;
	}

	/* check if we are running as non-root, and login user is different from the server */
	uid = geteuid();
	if (uid != 0 && uid != ses.authstate.pw_uid) {
	TRACE(("running as nonroot, only server uid is allowed"))
	dropbear_log(LOG_WARNING,
	"Login attempt with wrong user %s from %s",
	ses.authstate.pw_name,
	svr_ses.addrstring);
	return DROPBEAR_FAILURE;
	}

	/* check for non-root if desired */
	if (svr_opts.norootlogin && ses.authstate.pw_uid == 0) {
	TRACE(("leave checkusername: root login disabled"))
	dropbear_log(LOG_WARNING, "root login rejected");
	return DROPBEAR_FAILURE;
	}

	TRACE(("shell is %s", ses.authstate.pw_shell))

	/* check that the shell is set */
	usershell = ses.authstate.pw_shell;
	if (usershell[0] == '\0') {
	/* empty shell in /etc/passwd means /bin/sh according to passwd(5) */
	usershell = "/bin/sh";
	}

	/* check the shell is valid. If /etc/shells doesn't exist, getusershell()
	* should return some standard shells like "/bin/sh" and "/bin/csh" (this
	* is platform-specific) */
	setusershell();
	while ((listshell = getusershell()) != NULL) {
	TRACE(("test shell is '%s'", listshell))
	if (strcmp(listshell, usershell) == 0) {
	/* have a match */
	goto goodshell;
	}
	}
	/* no matching shell */
	endusershell();
	TRACE(("no matching shell"))
	dropbear_log(LOG_WARNING, "User '%s' has invalid shell, rejected",
	ses.authstate.pw_name);
	return DROPBEAR_FAILURE;

	goodshell:
	endusershell();
	TRACE(("matching shell"))

	TRACE(("uid = %d", ses.authstate.pw_uid))
	TRACE(("leave checkusername"))
	return DROPBEAR_SUCCESS;
	}

	/* Send a failure message to the client, in responds to a userauth_request.
	* Partial indicates whether to set the "partial success" flag,
	* incrfail is whether to count this failure in the failure count (which
	* is limited. This function also handles disconnection after too many
	* failures */
	void send_msg_userauth_failure(int partial, int incrfail) {

	buffer *typebuf = NULL;

	TRACE(("enter send_msg_userauth_failure"))

	CHECKCLEARTOWRITE();

	buf_putbyte(ses.writepayload, SSH_MSG_USERAUTH_FAILURE);

	/* put a list of allowed types */
	typebuf = buf_new(30); /* long enough for PUBKEY and PASSWORD */

	if (ses.authstate.authtypes & AUTH_TYPE_PUBKEY) {
	buf_putbytes(typebuf, (const unsigned char *)AUTH_METHOD_PUBKEY, AUTH_METHOD_PUBKEY_LEN);
	if (ses.authstate.authtypes & AUTH_TYPE_PASSWORD) {
	buf_putbyte(typebuf, ',');
	}
	}

	if (ses.authstate.authtypes & AUTH_TYPE_PASSWORD) {
	buf_putbytes(typebuf, (const unsigned char *)AUTH_METHOD_PASSWORD, AUTH_METHOD_PASSWORD_LEN);
	}

	buf_putbufstring(ses.writepayload, typebuf);

	TRACE(("auth fail: methods %d, '%.*s'", ses.authstate.authtypes,
	typebuf->len, typebuf->data))

	buf_free(typebuf);

	buf_putbyte(ses.writepayload, partial ? 1 : 0);
	encrypt_packet();

	if (incrfail) {
	unsigned int delay;
	genrandom((unsigned char*)&delay, sizeof(delay));
	/* We delay for 300ms +- 50ms */
	delay = 250000 + (delay % 100000);
	usleep(delay);
	ses.authstate.failcount++;
	}

	if (ses.authstate.failcount >= MAX_AUTH_TRIES) {
	char * userstr;
	/* XXX - send disconnect ? */
	TRACE(("Max auth tries reached, exiting"))

	if (ses.authstate.pw_name == NULL) {
	userstr = "is invalid";
	} else {
	userstr = ses.authstate.pw_name;
	}
	dropbear_exit("Max auth tries reached - user '%s' from %s",
	userstr, svr_ses.addrstring);
	}

	TRACE(("leave send_msg_userauth_failure"))
	}

	/* Send a success message to the user, and set the "authdone" flag */
	void send_msg_userauth_success() {

	TRACE(("enter send_msg_userauth_success"))

	CHECKCLEARTOWRITE();

	buf_putbyte(ses.writepayload, SSH_MSG_USERAUTH_SUCCESS);
	encrypt_packet();

	/* authdone must be set after encrypt_packet() for
	* delayed-zlib mode */
	ses.authstate.authdone = 1;
	ses.connect_time = 0;


	if (ses.authstate.pw_uid == 0) {
	ses.allowprivport = 1;
	}

	/* Remove from the list of pre-auth sockets. Should be m_close(), since if
	* we fail, we might end up leaking connection slots, and disallow new
	* logins - a nasty situation. */
	m_close(svr_ses.childpipe);

	TRACE(("leave send_msg_userauth_success"))

	}