From e39d6f7e68695c9aea5ca03e1bb4232f249f6ce8 Mon Sep 17 00:00:00 2001 From: Matt Johnston Date: Wed, 17 Apr 2013 22:29:18 +0800 Subject: If running as non-root only allow that user to log in --- svr-auth.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'svr-auth.c') diff --git a/svr-auth.c b/svr-auth.c index 404232e..1912660 100644 --- a/svr-auth.c +++ b/svr-auth.c @@ -226,6 +226,7 @@ static int checkusername(unsigned char *username, unsigned int userlen) { char* listshell = NULL; char* usershell = NULL; + int uid; TRACE(("enter checkusername")) if (userlen > MAX_USERNAME_LEN) { return DROPBEAR_FAILURE; @@ -255,6 +256,18 @@ static int checkusername(unsigned char *username, unsigned int userlen) { return DROPBEAR_FAILURE; } + /* check if we are running as non-root, and login user is different from the server */ + uid = geteuid(); + if (uid != 0 && uid != ses.authstate.pw_uid) { + TRACE(("running as nonroot, only server uid is allowed")) + dropbear_log(LOG_WARNING, + "Login attempt with wrong user %s from %s", + ses.authstate.pw_name, + svr_ses.addrstring); + send_msg_userauth_failure(0, 1); + return DROPBEAR_FAILURE; + } + /* check for non-root if desired */ if (svr_opts.norootlogin && ses.authstate.pw_uid == 0) { TRACE(("leave checkusername: root login disabled")) -- cgit v1.2.1