mirror of
https://github.com/openbsd/src.git
synced 2025-01-10 06:47:55 -08:00
Replace skeyaudit.sh with a setuid binary (necessary for mode 0600 skeykeys)
This commit is contained in:
millert
parent
d0b45db945
commit
0165dd6fc4
@ -1,7 +1,7 @@
|
||||
# $OpenBSD: Makefile,v 1.11 1997/07/23 04:10:50 millert Exp $
|
||||
# $OpenBSD: Makefile,v 1.12 1997/07/23 04:24:37 millert Exp $
|
||||
|
||||
PROG= skey
|
||||
MAN= skey.1 skeyaudit.1 skeyprune.8
|
||||
MAN= skey.1 skeyprune.8
|
||||
LINKS= ${BINDIR}/skey ${BINDIR}/otp-md4 \
|
||||
${BINDIR}/skey ${BINDIR}/otp-md5 \
|
||||
${BINDIR}/skey ${BINDIR}/otp-sha1 \
|
||||
@ -14,8 +14,6 @@ DPADD= ${LIBSKEY}
|
||||
LDADD= -lskey
|
||||
|
||||
beforeinstall:
|
||||
${INSTALL} ${INSTALL_COPY} -m 755 ${.CURDIR}/skeyaudit.sh \
|
||||
${DESTDIR}${BINDIR}/skeyaudit
|
||||
${INSTALL} ${INSTALL_COPY} -m 755 ${.CURDIR}/skeyprune.pl \
|
||||
${DESTDIR}${BINDIR}/skeyprune
|
||||
|
||||
|
||||
@ -1,29 +0,0 @@
|
||||
.\" $OpenBSD: skeyaudit.1,v 1.3 1996/10/08 01:20:55 michaels Exp $
|
||||
.\"
|
||||
.\"
|
||||
.Dd 9 June 1994
|
||||
.Dt SKEYAUDIT 1
|
||||
.Os
|
||||
.Sh NAME
|
||||
.Nm skeyaudit
|
||||
.Nd warn users if their S/Key will soon expire
|
||||
.Sh SYNOPSIS
|
||||
.Nm skeyaudit
|
||||
.Op Ar limit
|
||||
.Sh DESCRIPTION
|
||||
.Nm skeyaudit
|
||||
searches through the file
|
||||
.Dq Pa /etc/skeykeys
|
||||
for users whose S/Key sequence number is less than
|
||||
.Ar limit ,
|
||||
and sends them a reminder to run
|
||||
.Xr skeyinit 1
|
||||
soon. If no limit is specified a default of 12 is used.
|
||||
.Sh FILES
|
||||
.Bl -tag -width /etc/skeykeys -compact
|
||||
.It Pa /etc/skeykeys
|
||||
The S/Key key information database
|
||||
.El
|
||||
.Sh SEE ALSO
|
||||
.Xr skeyinit 1 ,
|
||||
.Xr skey 1
|
||||
@ -1,50 +0,0 @@
|
||||
#!/bin/sh
|
||||
# $OpenBSD: skeyaudit.sh,v 1.4 1996/09/29 04:46:18 millert Exp $
|
||||
# This script will look thru the skeykeys file for
|
||||
# people with sequence numbers less then LOWLIMIT=12
|
||||
# and send them an e-mail reminder to use skeyinit soon
|
||||
#
|
||||
|
||||
AWK=/usr/bin/awk
|
||||
GREP=/usr/bin/grep
|
||||
ECHO=/bin/echo
|
||||
KEYDB=/etc/skeykeys
|
||||
LOWLIMIT=12
|
||||
ADMIN=root
|
||||
SUBJECT="Reminder: Run skeyinit"
|
||||
HOST=`/bin/hostname`
|
||||
|
||||
|
||||
if [ "$1" != "" ]
|
||||
then
|
||||
LOWLIMIT=$1
|
||||
fi
|
||||
|
||||
|
||||
# an skeykeys entry looks like
|
||||
# jsw 0076 la13079 ba20a75528de9d3a
|
||||
# the sequence number is the second entry
|
||||
#
|
||||
|
||||
for i in `$AWK '{print $1}' $KEYDB`
|
||||
do
|
||||
SEQ=`$GREP "^$i[ ]" $KEYDB | $AWK '{if ($2 ~ /^[A-z]/) {print $3} else {print $2}}'`
|
||||
if [ $SEQ -lt $LOWLIMIT ]
|
||||
then
|
||||
KEY=`$GREP "^$i[ ]" $KEYDB | $AWK '{if ($2 ~ /^[A-z]/) {print $4} else {print $3}}'`
|
||||
if [ $SEQ -lt 3 ]
|
||||
then
|
||||
SUBJECT="IMPORTANT action required"
|
||||
fi
|
||||
(
|
||||
$ECHO "You are nearing the end of your current S/Key sequence for account $i"
|
||||
$ECHO "on system $HOST."
|
||||
$ECHO ""
|
||||
$ECHO "Your S/key sequence number is now $SEQ. When it reaches zero you"
|
||||
$ECHO "will no longer be able to use S/Key to login into the system. "
|
||||
$ECHO " "
|
||||
$ECHO "Type \"skeyinit -s\" to reinitialize your sequence number."
|
||||
$ECHO ""
|
||||
) | /usr/bin/Mail -s "$SUBJECT" $i $ADMIN
|
||||
fi
|
||||
done
|
||||
9
usr.bin/skeyaudit/Makefile
Normal file
9
usr.bin/skeyaudit/Makefile
Normal file
@ -0,0 +1,9 @@
|
||||
# $OpenBSD: Makefile,v 1.1 1997/07/23 04:24:33 millert Exp $
|
||||
|
||||
PROG= skeyaudit
|
||||
BINOWN= root
|
||||
BINMODE=4555
|
||||
DPADD= ${LIBSKEY}
|
||||
LDADD= -lskey
|
||||
|
||||
.include <bsd.prog.mk>
|
||||
39
usr.bin/skeyaudit/skeyaudit.1
Normal file
39
usr.bin/skeyaudit/skeyaudit.1
Normal file
@ -0,0 +1,39 @@
|
||||
.\" $OpenBSD: skeyaudit.1,v 1.1 1997/07/23 04:24:35 millert Exp $
|
||||
.\"
|
||||
.\"
|
||||
.Dd 22 July 1997
|
||||
.Dt SKEYAUDIT 1
|
||||
.Os
|
||||
.Sh NAME
|
||||
.Nm skeyaudit
|
||||
.Nd warn users if their S/Key will soon expire
|
||||
.Sh SYNOPSIS
|
||||
.Nm skeyaudit
|
||||
.Op Fl i
|
||||
.Op Fl l Ar limit
|
||||
.Sh DESCRIPTION
|
||||
.Nm skeyaudit
|
||||
searches through the file
|
||||
.Dq Pa /etc/skeykeys
|
||||
for users whose S/Key sequence number is less than
|
||||
.Ar limit ,
|
||||
and mails them a reminder to run
|
||||
.Xr skeyinit 1
|
||||
soon.
|
||||
.Sh OPTIONS
|
||||
.Bl -tag -width "-l limit" -indent
|
||||
The available options are as follows:
|
||||
.It Fl i
|
||||
Interactive mode. Don't send mail, just print to standard output.
|
||||
.It Fl l Ar limit
|
||||
The limit used to determine whether or not a user should
|
||||
be notified. The default is to notify if there are fewer
|
||||
than 12 keys left.
|
||||
.Sh FILES
|
||||
.Bl -tag -width /etc/skeykeys -compact
|
||||
.It Pa /etc/skeykeys
|
||||
The S/Key key information database
|
||||
.El
|
||||
.Sh SEE ALSO
|
||||
.Xr skeyinit 1 ,
|
||||
.Xr skey 1
|
||||
113
usr.bin/skeyaudit/skeyaudit.c
Normal file
113
usr.bin/skeyaudit/skeyaudit.c
Normal file
@ -0,0 +1,113 @@
|
||||
#include <err.h>
|
||||
#include <errno.h>
|
||||
#include <limits.h>
|
||||
#include <paths.h>
|
||||
#include <pwd.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <unistd.h>
|
||||
#include <skey.h>
|
||||
|
||||
#include <sys/types.h>
|
||||
#include <sys/param.h>
|
||||
|
||||
extern char *__progname;
|
||||
|
||||
void usage __P((void));
|
||||
|
||||
int
|
||||
main(argc, argv)
|
||||
int argc;
|
||||
char **argv;
|
||||
{
|
||||
struct passwd *pw;
|
||||
struct skey key;
|
||||
int ch, errs, left = 0, iflag = 0, limit = 12;
|
||||
char *name, hostname[MAXHOSTNAMELEN];
|
||||
FILE *out;
|
||||
|
||||
while ((ch = getopt(argc, argv, "il:")) != -1)
|
||||
switch(ch) {
|
||||
case 'i':
|
||||
iflag = 1;
|
||||
break;
|
||||
case 'l':
|
||||
errno = 0;
|
||||
if ((limit = (int)strtol(optarg, NULL, 10)) == 0)
|
||||
errno = ERANGE;
|
||||
if (errno) {
|
||||
warn("key limit");
|
||||
usage();
|
||||
}
|
||||
break;
|
||||
default:
|
||||
usage();
|
||||
}
|
||||
|
||||
if (argc - optind > 0)
|
||||
usage();
|
||||
|
||||
if ((pw = getpwuid(getuid())) == NULL)
|
||||
errx(1, "no passwd entry for uid %u", getuid());
|
||||
if ((name = strdup(pw->pw_name)) == NULL)
|
||||
err(1, "cannot allocate memory");
|
||||
sevenbit(name);
|
||||
|
||||
errs = skeylookup(&key, name);
|
||||
switch (errs) {
|
||||
case 0: /* Success! */
|
||||
left = key.n - 1;
|
||||
break;
|
||||
case -1: /* File error */
|
||||
/* XXX - _PATH_SKEYFILE should be in paths.h? */
|
||||
warnx("cannot open /etc/skeykeys");
|
||||
break;
|
||||
case 1: /* Unknown user */
|
||||
warnx("%s is not listed in /etc/skeykeys", name);
|
||||
}
|
||||
|
||||
setuid(getuid()); /* Run sendmail as user not root */
|
||||
|
||||
if (errs || left >= limit)
|
||||
exit(errs);
|
||||
|
||||
if (gethostname(hostname, sizeof(hostname)) == -1)
|
||||
strcpy(hostname, "unknown");
|
||||
|
||||
if (iflag) {
|
||||
out = stdout;
|
||||
} else {
|
||||
char cmd[sizeof(_PATH_SENDMAIL) + 3];
|
||||
|
||||
sprintf(cmd, "%s -t", _PATH_SENDMAIL);
|
||||
out = popen(cmd, "w");
|
||||
}
|
||||
|
||||
if (!iflag)
|
||||
(void)fprintf(out,
|
||||
"To: %s\nSubject: IMPORTANT action required\n", name);
|
||||
|
||||
(void)fprintf(out,
|
||||
"\nYou are nearing the end of your current S/Key sequence for account\n\
|
||||
%s on system %s.\n\n\
|
||||
Your S/key sequence number is now %d. When it reaches zero\n\
|
||||
you will no longer be able to use S/Key to login into the system.\n\n\
|
||||
Type \"skeyinit -s\" to reinitialize your sequence number.\n\n",
|
||||
name, hostname, left - 1);
|
||||
|
||||
if (iflag)
|
||||
(void)fclose(out);
|
||||
else
|
||||
(void)pclose(out);
|
||||
|
||||
exit(0);
|
||||
}
|
||||
|
||||
void
|
||||
usage()
|
||||
{
|
||||
(void)fprintf(stderr, "Usage: %s [-i] [-l limit]\n",
|
||||
__progname);
|
||||
exit(1);
|
||||
}
|
||||
Loading…
Reference in New Issue
Block a user