diff --git a/mod_absec.c b/mod_absec.c index 8c013d7..dd6b14a 100644 --- a/mod_absec.c +++ b/mod_absec.c @@ -194,86 +194,6 @@ static int absec_handler_first(request_rec *r) //ap_rprintf(r, "User/Pass: %s/%s \n
", user, pass); //////// - // Validate user/pass against unix cred - - //////// - // Get UID, GIDs for the user - /* Working example, but just UID not PW */ - /* - apr_status_t ret; - apr_uid_t i; - apr_gid_t g; - ret = apr_uid_get ( &i, &g, user, r->pool ); - ap_rprintf(r, "Result2: G:%d, I:%d \n
", g,i); - */ - - //////// - /* Retrieve PW (user details) from /etc/passwd */ - /* Should include */ - struct passwd *pw; - if((pw = getpwnam(user)) == NULL) - { - ap_rprintf(r, "NULL \n
"); - apr_table_setn(r->err_headers_out, - (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate" - : "WWW-Authenticate", - apr_pstrcat(r->pool, "Basic realm=\"USER INCONNU ", ap_auth_name(r), - "\"", NULL)); - // User cannot be found, unauthorized - return HTTP_UNAUTHORIZED; - } - - //////// - /* Retrieve PW from /etc/shadow */ - /* Should include */ -/* struct spwd *spw; - errno = 0; - if((spw = getspnam(user)) == NULL) - { - ap_rprintf(r, "NULL %d\n
", errno); - apr_table_setn(r->err_headers_out, - (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate" - : "WWW-Authenticate", - apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r), - "\"", NULL)); - return HTTP_UNAUTHORIZED; - } - else - { - ap_rprintf(r, "Shadow PW : %s \n
", spw->sp_pwdp); - } - - if (spw->sp_pwdp[0] == 'x' || spw->sp_pwdp[0] == '*' || spw->sp_pwdp[0] == '!') { - apr_table_setn(r->err_headers_out, - (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate" - : "WWW-Authenticate", - apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r), - "\"", NULL)); - return HTTP_UNAUTHORIZED; - }*/ - - //////// - /* Encrypt and compare shadow password */ - // TODO : Valider qu'on a un user - // TODO : Valider qu'il y a un password (pas * ! rien) -/* char *encrypted; - const char *correct; - int rrr; - encrypted = crypt(pass, spw->sp_pwdp); - rrr = strcmp(encrypted, spw->sp_pwdp); - ap_rprintf(r, "compare pw : %s \n
", encrypted);; - ap_rprintf(r, "compare : %d \n
", rrr); - if (rrr!=0) { - apr_table_setn(r->err_headers_out, - (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate" - : "WWW-Authenticate", - apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r), - "\"", NULL)); - return HTTP_UNAUTHORIZED; - } -*/ - - //////// // Connect to PAM to auth user pam_handle_t * pamh = NULL; int rret; @@ -294,7 +214,7 @@ static int absec_handler_first(request_rec *r) apr_table_setn(r->err_headers_out, (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate" : "WWW-Authenticate", - apr_pstrcat(r->pool, "Basic realm=\"PASSWORD INVALIDE ", ap_auth_name(r), + apr_pstrcat(r->pool, "Basic realm=\"USER/PASS INVALIDE ", ap_auth_name(r), "\"", NULL)); return HTTP_UNAUTHORIZED; printf("User auth failed\n"); @@ -311,6 +231,23 @@ static int absec_handler_first(request_rec *r) //////// // Continue checking permission + //////// + /* Retrieve user details from /etc/passwd to get uid and primary group */ + /* Should include */ + struct passwd *pw; + if((pw = getpwnam(user)) == NULL) + { + // Should never happend as already verified with PAM + ap_rprintf(r, "NULL \n
"); + apr_table_setn(r->err_headers_out, + (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate" + : "WWW-Authenticate", + apr_pstrcat(r->pool, "Basic realm=\"USER INCONNU ", ap_auth_name(r), + "\"", NULL)); + // User cannot be found, unauthorized + return HTTP_UNAUTHORIZED; + } + // If file is user readable and user match return content if ((fperm.st_uid==pw->pw_uid) && (fperm.st_mode & 0700 & permmask)) { ap_rprintf(r, "Fichier propriƩtaire
\r\n"); @@ -341,16 +278,7 @@ static int absec_handler_first(request_rec *r) return (DECLINED); } } - } else { -/* ap_rprintf(r, "Erreur pas de groupe supplementaires? (code %d)
\r\n", groupreturn); - r->content_type = "text/html"; - apr_table_setn(r->err_headers_out, - (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate" - : "WWW-Authenticate", - apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r), - "\"", NULL)); - return HTTP_UNAUTHORIZED; -*/ } + } // else decline request ap_rprintf(r, "Aucuns droits de voir le fichier
\r\n");