mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Do not allow login for expired and disabled users. Fix this even in openvpn authentication script. While here clean up the code quite a bit.

Browse Source
This commit is contained in:
Ermal Lui 2010-03-02 10:21:12 +00:00
parent d91f8b8c76
commit a13ce628f8
2 changed files with 43 additions and 70 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

89
etc/inc/auth.inc
View File

@ -148,6 +148,9 @@ function local_backed($username, $passwd) {
if (!$user)
return false;
if (is_account_disabled($username))
return false;
if ($user['password'])
{
$passwd = crypt($passwd, $user['password']);
@ -796,7 +799,7 @@ function ldap_backed($username, $passwd) {
}
function radius_backed($username, $passwd){
global $debug, $config, $debug;
global $debug, $config;
$ret = false;
$radiusservers = $config['system']['radius']['servers'];
@ -839,73 +842,59 @@ function radius_backed($username, $passwd){
}
function get_user_expiration_date($username) {
global $config;
foreach($config['system']['user'] as $user) {
if($user['name'] == $username) {
if($user['expires'])
return $user['expires'];
}
$user = getUserEntry($username);
if ($user['expires'])
return $user['expires'];
}
function is_account_expired($username) {
$expirydate = get_user_expiration_date($username);
if ($expirydate) {
if (strtotime("-1 day") > strtotime(date("m/d/Y",strtotime($expirydate))))
return true;
}
return false;
}
function is_account_disabled($username) {
global $config;
foreach($config['system']['user'] as $user)
if($user['name'] == $username)
if(isset($user['disabled']))
return true;
$user = getUserEntry($username);
if (isset($user['disabled']))
return true;
return false;
}
function session_auth($backing) {
global $g, $debug, $HTTP_SERVER_VARS, $userindex, $config, $_SESSION, $page;
global $debug, $HTTP_SERVER_VARS, $config, $_SESSION, $page;
session_start();
/* Validate incoming login request */
if (isset($_POST['login'])) {
if ($backing($_POST['usernamefld'], $_POST['passwordfld'])) {
$acct_expires = get_user_expiration_date($_POST['usernamefld']);
if($acct_expires) {
if (strtotime("-1 day") > strtotime(date("m/d/Y",strtotime($acct_expires)))) {
log_error("Attempted login for invalid user '{$_POST['usernamefld']}' from: {$_SERVER['REMOTE_ADDR']}");
if(isAjax()) {
echo "showajaxmessage('{$_SESSION['Login_Error']}');";
return;
}
if(is_account_disabled($_POST['usernamefld']) || is_account_disabled($_POST['usernamefld'])) {
$_SESSION['Login_Error'] = "Username or Password incorrect";
log_error("Login attempt with user: '{$_POST['usernamefld']}' from: '{$_SERVER['REMOTE_ADDR']}' failed.");
if(isAjax()) {
echo "showajaxmessage('{$_SESSION['Login_Error']}');";
return;
}
} else {
if(is_account_disabled($_POST['usernamefld'])) {
log_error("Attempted login for invalid user '{$_POST['usernamefld']}' from: {$_SERVER['REMOTE_ADDR']}");
if(isAjax()) {
echo "showajaxmessage('{$_SESSION['Login_Error']}');";
return;
}
} else {
$_SESSION['Logged_In'] = "True";
$_SESSION['Username'] = $_POST['usernamefld'];
$_SESSION['last_access'] = time();
log_error("Successful login for user '{$_POST['usernamefld']}' from: {$_SERVER['REMOTE_ADDR']}");
require_once("functions.inc");
pfSenseHeader("/{$page}");
}
$_SESSION['Logged_In'] = "True";
$_SESSION['Username'] = $_POST['usernamefld'];
$_SESSION['last_access'] = time();
log_error("Successful login for user '{$_POST['usernamefld']}' from: {$_SERVER['REMOTE_ADDR']}");
require_once("functions.inc");
pfSenseHeader("/{$page}");
}
} else {
/* give the user a more detailed error message */
if (isset($userindex[$_POST['usernamefld']])) {
$_SESSION['Login_Error'] = "Username or Password incorrect";
log_error("Wrong password entered for user '{$_POST['usernamefld']}' from: {$_SERVER['REMOTE_ADDR']}");
if(isAjax()) {
echo "showajaxmessage('{$_SESSION['Login_Error']}');";
return;
}
} else {
$_SESSION['Login_Error'] = "Username or Password incorrect";
log_error("Attempted login for invalid user '{$_POST['usernamefld']}' from: {$_SERVER['REMOTE_ADDR']}");
if(isAjax()) {
echo "showajaxmessage('{$_SESSION['Login_Error']}');";
return;
}
/* give the user an error message */
$_SESSION['Login_Error'] = "Username or Password incorrect";
log_error("Login attempt with user: '{$_POST['usernamefld']}' from: '{$_SERVER['REMOTE_ADDR']}' failed.");
if(isAjax()) {
echo "showajaxmessage('{$_SESSION['Login_Error']}');";
return;
}
}
}

24
etc/inc/openvpn.auth-user.php
View File

@ -41,14 +41,7 @@
*/
require_once("config.inc");
function & lookup_user($name) {
global $config;
foreach($config['system']['user'] as & $userent)
if ($userent['name'] == $name)
return $userent;
}
require_once("auth.inc");
/* setup syslog logging */
openlog("openvpn", LOG_ODELAY, LOG_AUTH);
@ -63,22 +56,13 @@ if (!$username || !$password) {
}
/* lookup user object by name */
$user =& lookup_user($username);
if (!$user) {
syslog(LOG_WARNING, "user {$username} is unknown");
if (!local_backed($username, $password)) {
syslog(LOG_WARNING, "user {$username} supplied an invalid password\n");
exit(-2);
}
/* authenticate the user */
$password = crypt($password, $user['password']);
if ($password != $user['password']) {
syslog(LOG_WARNING, "user {$username} supplied an invalid password\n");
exit(-3);
}
syslog(LOG_WARNING, "user {$username} authenticated\n");
exit(0);
?>