2 * Amanda, The Advanced Maryland Automatic Network Disk Archiver
3 * Copyright (c) 1999 University of Maryland
6 * Permission to use, copy, modify, distribute, and sell this software and its
7 * documentation for any purpose is hereby granted without fee, provided that
8 * the above copyright notice appear in all copies and that both that
9 * copyright notice and this permission notice appear in supporting
10 * documentation, and that the name of U.M. not be used in advertising or
11 * publicity pertaining to distribution of the software without specific,
12 * written prior permission. U.M. makes no representations about the
13 * suitability of this software for any purpose. It is provided "as is"
14 * without express or implied warranty.
16 * U.M. DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL
17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL U.M.
18 * BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
19 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
20 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
21 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
23 * Authors: the Amanda Development Team. Its members are listed in a
24 * file named AUTHORS, in the root directory of this distribution.
28 * $Id: ssh-security.c,v 1.23 2006/08/21 20:17:10 martinea Exp $
30 * ssh-security.c - security and transport over ssh or a ssh-like command.
32 * XXX still need to check for initial keyword on connect so we can skip
33 * over shell garbage and other stuff that ssh might want to spew out.
42 #include "security-util.h"
56 #define sshprintf(x) \
64 * Path to the ssh binary. This should be configurable.
66 #define SSH_PATH "/usr/bin/ssh"
69 * Arguments to ssh. This should also be configurable
71 #define SSH_ARGS "-x", "-o", "BatchMode=yes", "-o", "PreferredAuthentications=publickey"
74 * Number of seconds ssh has to start up
76 #define CONNECT_TIMEOUT 20
79 * Magic values for ssh_conn->handle
81 #define H_TAKEN -1 /* ssh_conn->tok was already read */
82 #define H_EOF -2 /* this connection has been shut down */
87 static void ssh_connect(const char *, char *(*)(char *, void *),
88 void (*)(void *, security_handle_t *, security_status_t),
92 * This is our interface to the outside world.
94 const security_driver_t ssh_security_driver = {
101 stream_recvpkt_cancel,
110 tcpm_stream_read_sync,
111 tcpm_stream_read_cancel,
112 tcpm_close_connection,
115 static int newhandle = 1;
120 static int runssh(struct tcp_conn *, const char *, const char *, const char *);
123 * ssh version of a security handle allocator. Logically sets
124 * up a network "connection".
128 const char * hostname,
129 char * (*conf_fn)(char *, void *),
130 void (*fn)(void *, security_handle_t *, security_status_t),
134 struct sec_handle *rh;
136 char *amandad_path=NULL, *client_username=NULL, *ssh_keys=NULL;
139 assert(hostname != NULL);
141 (void)conf_fn; /* Quiet unused parameter warning */
143 sshprintf(("%s: ssh: ssh_connect: %s\n", debug_prefix_time(NULL),
146 rh = alloc(SIZEOF(*rh));
147 security_handleinit(&rh->sech, &ssh_security_driver);
150 rh->ev_timeout = NULL;
153 if ((he = gethostbyname(hostname)) == NULL) {
154 security_seterror(&rh->sech,
155 "%s: ssh could not resolve hostname", hostname);
156 (*fn)(arg, &rh->sech, S_ERROR);
159 rh->hostname = stralloc(he->h_name); /* will be replaced */
160 rh->rs = tcpma_stream_client(rh, newhandle++);
165 amfree(rh->hostname);
166 rh->hostname = stralloc(rh->rs->rc->hostname);
169 * We need to open a new connection.
171 * XXX need to eventually limit number of outgoing connections here.
174 amandad_path = conf_fn("amandad_path", datap);
175 client_username = conf_fn("client_username", datap);
176 ssh_keys = conf_fn("ssh_keys", datap);
178 if(rh->rc->read == -1) {
179 if (runssh(rh->rs->rc, amandad_path, client_username, ssh_keys) < 0) {
180 security_seterror(&rh->sech, "can't connect to %s: %s",
181 hostname, rh->rs->rc->errmsg);
188 * The socket will be opened async so hosts that are down won't
189 * block everything. We need to register a write event
190 * so we will know when the socket comes alive.
192 * Overload rh->rs->ev_read to provide a write event handle.
193 * We also register a timeout.
197 rh->rs->ev_read = event_register((event_id_t)rh->rs->rc->write, EV_WRITEFD,
198 sec_connect_callback, rh);
199 rh->ev_timeout = event_register((event_id_t)CONNECT_TIMEOUT, EV_TIME,
200 sec_connect_timeout, rh);
205 (*fn)(arg, &rh->sech, S_ERROR);
209 * Forks a ssh to the host listed in rc->hostname
210 * Returns negative on error, with an errmsg in rc->errmsg.
214 struct tcp_conn * rc,
215 const char * amandad_path,
216 const char * client_username,
217 const char * ssh_keys)
219 int rpipe[2], wpipe[2];
220 char *xamandad_path = (char *)amandad_path;
221 char *xclient_username = (char *)client_username;
222 char *xssh_keys = (char *)ssh_keys;
224 memset(rpipe, -1, SIZEOF(rpipe));
225 memset(wpipe, -1, SIZEOF(wpipe));
226 if (pipe(rpipe) < 0 || pipe(wpipe) < 0) {
227 rc->errmsg = newvstralloc(rc->errmsg, "pipe: ", strerror(errno), NULL);
231 switch (rc->pid = fork()) {
233 rc->errmsg = newvstralloc(rc->errmsg, "fork: ", strerror(errno), NULL);
246 rc->write = wpipe[1];
253 if(!xamandad_path || strlen(xamandad_path) <= 1)
254 xamandad_path = vstralloc(libexecdir, "/", "amandad",
255 versionsuffix(), NULL);
256 if(!xclient_username || strlen(xclient_username) <= 1)
257 xclient_username = CLIENT_LOGIN;
258 if(!ssh_keys || strlen(ssh_keys) <= 1) {
259 execlp(SSH_PATH, SSH_PATH, SSH_ARGS, "-l", xclient_username,
260 rc->hostname, xamandad_path, "-auth=ssh", "amdump", "amindexd",
261 "amidxtaped", (char *)NULL);
264 execlp(SSH_PATH, SSH_PATH, SSH_ARGS, "-l", xclient_username,
265 "-i", xssh_keys, rc->hostname, xamandad_path, "-auth=ssh",
266 "amdump", "amindexd", "amidxtaped", (char *)NULL);
268 error("error: couldn't exec %s: %s", SSH_PATH, strerror(errno));
270 /* should never go here, shut up compiler warning */
274 #endif /* SSH_SECURITY */