version 1.532, 2017/02/28 05:42:06
|
version 1.533, 2017/03/13 18:30:02
|
Line 2323 sub hash_passwd {
|
Line 2323 sub hash_passwd {
|
my $plainsalt = substr($rest[1],0,22); |
my $plainsalt = substr($rest[1],0,22); |
$salt = Crypt::Eksblowfish::Bcrypt::de_base64($plainsalt); |
$salt = Crypt::Eksblowfish::Bcrypt::de_base64($plainsalt); |
} else { |
} else { |
my $defaultcost; |
my %domdefaults = &Apache::lonnet::get_domain_defaults($domain); |
my %domconfig = |
my $defaultcost = $domdefaults{'intauth_cost'}; |
&Apache::lonnet::get_dom('configuration',['password'],$domain); |
|
if (ref($domconfig{'password'}) eq 'HASH') { |
|
$defaultcost = $domconfig{'password'}{'cost'}; |
|
} |
|
if (($defaultcost eq '') || ($defaultcost =~ /D/)) { |
if (($defaultcost eq '') || ($defaultcost =~ /D/)) { |
$cost = 10; |
$cost = 10; |
} else { |
} else { |
Line 7372 sub make_new_child {
|
Line 7368 sub make_new_child {
|
."Attempted insecure connection disallowed </font>"); |
."Attempted insecure connection disallowed </font>"); |
close $client; |
close $client; |
$clientok = 0; |
$clientok = 0; |
|
|
} |
} |
} |
} |
} else { |
} else { |
Line 7381 sub make_new_child {
|
Line 7376 sub make_new_child {
|
."$clientip failed to initialize: >$remotereq< </font>"); |
."$clientip failed to initialize: >$remotereq< </font>"); |
&status('No init '.$clientip); |
&status('No init '.$clientip); |
} |
} |
|
|
} else { |
} else { |
&logthis( |
&logthis( |
"<font color='blue'>WARNING: Unknown client $clientip</font>"); |
"<font color='blue'>WARNING: Unknown client $clientip</font>"); |
Line 7618 sub password_filename {
|
Line 7612 sub password_filename {
|
# domain - domain of the user. |
# domain - domain of the user. |
# name - User's name. |
# name - User's name. |
# contents - New contents of the file. |
# contents - New contents of the file. |
|
# saveold - (optional). If true save old file in a passwd.bak file. |
# Returns: |
# Returns: |
# 0 - Failed. |
# 0 - Failed. |
# 1 - Success. |
# 1 - Success. |
# |
# |
sub rewrite_password_file { |
sub rewrite_password_file { |
my ($domain, $user, $contents) = @_; |
my ($domain, $user, $contents, $saveold) = @_; |
|
|
my $file = &password_filename($domain, $user); |
my $file = &password_filename($domain, $user); |
if (defined $file) { |
if (defined $file) { |
|
if ($saveold) { |
|
my $bakfile = $file.'.bak'; |
|
if (CopyFile($file,$bakfile)) { |
|
chmod(0400,$bakfile); |
|
&logthis("Old password saved in passwd.bak for internally authenticated user: $user:$domain"); |
|
} else { |
|
&logthis("Failed to save old password in passwd.bak for internally authenticated user: $user:$domain"); |
|
} |
|
} |
my $pf = IO::File->new(">$file"); |
my $pf = IO::File->new(">$file"); |
if($pf) { |
if($pf) { |
print $pf "$contents\n"; |
print $pf "$contents\n"; |
Line 7717 sub validate_user {
|
Line 7721 sub validate_user {
|
$contentpwd = $domdefaults{'auth_arg_def'}; |
$contentpwd = $domdefaults{'auth_arg_def'}; |
} |
} |
} |
} |
} |
} |
if ($howpwd ne 'nouser') { |
if ($howpwd ne 'nouser') { |
if($howpwd eq "internal") { # Encrypted is in local password file. |
if($howpwd eq "internal") { # Encrypted is in local password file. |
if (length($contentpwd) == 13) { |
if (length($contentpwd) == 13) { |
$validated = (crypt($password,$contentpwd) eq $contentpwd); |
$validated = (crypt($password,$contentpwd) eq $contentpwd); |
if ($validated) { |
if ($validated) { |
my $ncpass = &hash_passwd($domain,$password); |
my %domdefaults = &Apache::lonnet::get_domain_defaults($domain); |
if (&rewrite_password_file($domain,$user,"$howpwd:$ncpass")) { |
if ($domdefaults{'intauth_switch'}) { |
&update_passwd_history($user,$domain,$howpwd,'conversion'); |
my $ncpass = &hash_passwd($domain,$password); |
&logthis("Validated password hashed with bcrypt for $user:$domain"); |
my $saveold; |
|
if ($domdefaults{'intauth_switch'} == 2) { |
|
$saveold = 1; |
|
} |
|
if (&rewrite_password_file($domain,$user,"$howpwd:$ncpass",$saveold)) { |
|
&update_passwd_history($user,$domain,$howpwd,'conversion'); |
|
&logthis("Validated password hashed with bcrypt for $user:$domain"); |
|
} |
} |
} |
} |
} |
} else { |
} else { |
$validated = &check_internal_passwd($password,$contentpwd,$domain); |
$validated = &check_internal_passwd($password,$contentpwd,$domain,$user); |
} |
} |
} |
} |
elsif ($howpwd eq "unix") { # User is a normal unix user. |
elsif ($howpwd eq "unix") { # User is a normal unix user. |
Line 7800 sub validate_user {
|
Line 7811 sub validate_user {
|
} |
} |
|
|
sub check_internal_passwd { |
sub check_internal_passwd { |
my ($plainpass,$stored,$domain) = @_; |
my ($plainpass,$stored,$domain,$user) = @_; |
my (undef,$method,@rest) = split(/!/,$stored); |
my (undef,$method,@rest) = split(/!/,$stored); |
if ($method eq "bcrypt") { |
if ($method eq 'bcrypt') { |
my $result = &hash_passwd($domain,$plainpass,@rest); |
my $result = &hash_passwd($domain,$plainpass,@rest); |
if ($result ne $stored) { |
if ($result ne $stored) { |
return 0; |
return 0; |
} |
} |
# Upgrade to a larger number of rounds if necessary |
my %domdefaults = &Apache::lonnet::get_domain_defaults($domain); |
my $defaultcost; |
if ($domdefaults{'intauth_check'}) { |
my %domconfig = |
# Upgrade to a larger number of rounds if necessary |
&Apache::lonnet::get_dom('configuration',['password'],$domain); |
my $defaultcost = $domdefaults{'intauth_cost'}; |
if (ref($domconfig{'password'}) eq 'HASH') { |
if (($defaultcost eq '') || ($defaultcost =~ /D/)) { |
$defaultcost = $domconfig{'password'}{'cost'}; |
$defaultcost = 10; |
} |
} |
if (($defaultcost eq '') || ($defaultcost =~ /D/)) { |
if (int($rest[0])<int($defaultcost)) { |
$defaultcost = 10; |
if ($domdefaults{'intauth_check'} == 1) { |
|
my $ncpass = &hash_passwd($domain,$plainpass); |
|
if (&rewrite_password_file($domain,$user,"internal:$ncpass")) { |
|
&update_passwd_history($user,$domain,'internal','update cost'); |
|
&logthis("Validated password hashed with bcrypt for $user:$domain"); |
|
} |
|
return 1; |
|
} elsif ($domdefaults{'intauth_check'} == 2) { |
|
return 0; |
|
} |
|
} |
|
} else { |
|
return 1; |
} |
} |
return 1 unless($rest[0]<$defaultcost); |
|
} |
} |
return 0; |
return 0; |
} |
} |