diff options
author | dtucker <dtucker> | 2005-01-24 10:55:49 +0000 |
---|---|---|
committer | dtucker <dtucker> | 2005-01-24 10:55:49 +0000 |
commit | 9aba4fcf66b54d4ede75dc7dfe01a9214792ca12 (patch) | |
tree | b5021844f0c9a0afa1f48244acca068b47665477 /auth-passwd.c | |
parent | 3a75b5a57f8f6e87f47ca81816ef93f82873f5bf (diff) | |
download | openssh-9aba4fcf66b54d4ede75dc7dfe01a9214792ca12.tar.gz |
- otto@cvs.openbsd.org 2005/01/21 08:32:02
[auth-passwd.c sshd.c]
Warn in advance for password and account expiry; initialize loginmsg
buffer earlier and clear it after privsep fork. ok and help dtucker@
markus@
Diffstat (limited to 'auth-passwd.c')
-rw-r--r-- | auth-passwd.c | 51 |
1 files changed, 50 insertions, 1 deletions
diff --git a/auth-passwd.c b/auth-passwd.c index 7a68e056..2e5fbc73 100644 --- a/auth-passwd.c +++ b/auth-passwd.c @@ -36,17 +36,27 @@ */ #include "includes.h" -RCSID("$OpenBSD: auth-passwd.c,v 1.31 2004/01/30 09:48:57 markus Exp $"); +RCSID("$OpenBSD: auth-passwd.c,v 1.32 2005/01/21 08:32:02 otto Exp $"); #include "packet.h" +#include "buffer.h" #include "log.h" #include "servconf.h" #include "auth.h" #include "auth-options.h" +extern Buffer loginmsg; extern ServerOptions options; int sys_auth_passwd(Authctxt *, const char *); +#ifdef HAVE_LOGIN_CAP +extern login_cap_t *lc; +#endif + + +#define DAY (24L * 60 * 60) /* 1 day in seconds */ +#define TWO_WEEKS (2L * 7 * DAY) /* 2 weeks in seconds */ + void disable_forwarding(void) { @@ -111,11 +121,46 @@ auth_password(Authctxt *authctxt, const char *password) } #ifdef BSD_AUTH +static void +warn_expiry(Authctxt *authctxt, auth_session_t *as) +{ + char buf[256]; + quad_t pwtimeleft, actimeleft, daysleft, pwwarntime, acwarntime; + + pwwarntime = acwarntime = TWO_WEEKS; + + pwtimeleft = auth_check_change(as); + actimeleft = auth_check_expire(as); +#if HAVE_LOGIN_CAP + if (authctxt->valid) { + pwwarntime = login_getcaptime(lc, "password-warn", TWO_WEEKS, + TWO_WEEKS); + acwarntime = login_getcaptime(lc, "expire-warn", TWO_WEEKS, + TWO_WEEKS); + } +#endif + if (pwtimeleft != 0 && pwtimeleft < pwwarntime) { + daysleft = pwtimeleft / DAY + 1; + snprintf(buf, sizeof(buf), + "Your password will expire in %lld day%s.\n", + daysleft, daysleft == 1 ? "" : "s"); + buffer_append(&loginmsg, buf, strlen(buf)); + } + if (actimeleft != 0 && actimeleft < acwarntime) { + daysleft = actimeleft / DAY + 1; + snprintf(buf, sizeof(buf), + "Your account will expire in %lld day%s.\n", + daysleft, daysleft == 1 ? "" : "s"); + buffer_append(&loginmsg, buf, strlen(buf)); + } +} + int sys_auth_passwd(Authctxt *authctxt, const char *password) { struct passwd *pw = authctxt->pw; auth_session_t *as; + static int expire_checked = 0; as = auth_usercheck(pw->pw_name, authctxt->style, "auth-ssh", (char *)password); @@ -125,6 +170,10 @@ sys_auth_passwd(Authctxt *authctxt, const char *password) authctxt->force_pwchange = 1; return (1); } else { + if (!expire_checked) { + expire_checked = 1; + warn_expiry(authctxt, as); + } return (auth_close(as)); } } |