--- loncom/lond 2014/06/09 19:47:51 1.489.2.15 +++ loncom/lond 2016/08/11 16:37:54 1.489.2.21 @@ -2,7 +2,7 @@ # The LearningOnline Network # lond "LON Daemon" Server (port "LOND" 5663) # -# $Id: lond,v 1.489.2.15 2014/06/09 19:47:51 raeburn Exp $ +# $Id: lond,v 1.489.2.21 2016/08/11 16:37:54 raeburn Exp $ # # Copyright Michigan State University Board of Trustees # @@ -55,13 +55,16 @@ use LONCAPA::lonssl; use Fcntl qw(:flock); use Apache::lonnet; use Mail::Send; +use Crypt::Eksblowfish::Bcrypt; +use Digest::SHA; +use Encode; my $DEBUG = 0; # Non zero to enable debug log entries. my $status=''; my $lastlog=''; -my $VERSION='$Revision: 1.489.2.15 $'; #' stupid emacs +my $VERSION='$Revision: 1.489.2.21 $'; #' stupid emacs my $remoteVERSION; my $currenthostid="default"; my $currentdomainid; @@ -2017,15 +2020,14 @@ sub change_password_handler { my ($howpwd,$contentpwd)=split(/:/,$realpasswd); if ($howpwd eq 'internal') { &Debug("internal auth"); - my $salt=time; - $salt=substr($salt,6,2); - my $ncpass=crypt($npass,$salt); + my $ncpass = &hash_passwd($udom,$npass); if(&rewrite_password_file($udom, $uname, "internal:$ncpass")) { my $msg="Result of password change for $uname: pwchange_success"; if ($lonhost) { $msg .= " - request originated from: $lonhost"; } &logthis($msg); + &update_passwd_history($uname,$udom,$howpwd,$context); &Reply($client, "ok\n", $userinput); } else { &logthis("Unable to open $uname passwd " @@ -2034,6 +2036,9 @@ sub change_password_handler { } } elsif ($howpwd eq 'unix' && $context ne 'reset_by_email') { my $result = &change_unix_password($uname, $npass); + if ($result eq 'ok') { + &update_passwd_history($uname,$udom,$howpwd,$context); + } &logthis("Result of password change for $uname: ". $result); &Reply($client, \$result, $userinput); @@ -2056,6 +2061,42 @@ sub change_password_handler { } ®ister_handler("passwd", \&change_password_handler, 1, 1, 0); +sub hash_passwd { + my ($domain,$plainpass,@rest) = @_; + my ($salt,$cost); + if (@rest) { + $cost = $rest[0]; + # salt is first 22 characters, base-64 encoded by bcrypt + my $plainsalt = substr($rest[1],0,22); + $salt = Crypt::Eksblowfish::Bcrypt::de_base64($plainsalt); + } else { + my $defaultcost; + my %domconfig = + &Apache::lonnet::get_dom('configuration',['password'],$domain); + if (ref($domconfig{'password'}) eq 'HASH') { + $defaultcost = $domconfig{'password'}{'cost'}; + } + if (($defaultcost eq '') || ($defaultcost =~ /D/)) { + $cost = 10; + } else { + $cost = $defaultcost; + } + # Generate random 16-octet base64 salt + $salt = ""; + $salt .= pack("C", int rand(256)) for 1..16; + } + my $hash = &Crypt::Eksblowfish::Bcrypt::bcrypt_hash({ + key_nul => 1, + cost => $cost, + salt => $salt, + }, Digest::SHA::sha512(Encode::encode('UTF-8',$plainpass))); + + my $result = join("!", "", "bcrypt", sprintf("%02d",$cost), + &Crypt::Eksblowfish::Bcrypt::en_base64($salt). + &Crypt::Eksblowfish::Bcrypt::en_base64($hash)); + return $result; +} + # # Create a new user. User in this case means a lon-capa user. # The user must either already exist in some authentication realm @@ -2099,7 +2140,8 @@ sub add_user_handler { ."makeuser"; } unless ($fperror) { - my $result=&make_passwd_file($uname,$udom,$umode,$npass, $passfilename); + my $result=&make_passwd_file($uname,$udom,$umode,$npass, + $passfilename,'makeuser'); &Reply($client,\$result, $userinput); #BUGBUG - could be fail } else { &Failure($client, \$fperror, $userinput); @@ -2168,12 +2210,14 @@ sub change_authentication_handler { my $result = &change_unix_password($uname, $npass); &logthis("Result of password change for $uname: ".$result); if ($result eq "ok") { + &update_passwd_history($uname,$udom,$umode,'changeuserauth'); &Reply($client, \$result); } else { &Failure($client, \$result); } } else { - my $result=&make_passwd_file($uname,$udom,$umode,$npass,$passfilename); + my $result=&make_passwd_file($uname,$udom,$umode,$npass, + $passfilename,'changeuserauth'); # # If the current auth mode is internal, and the old auth mode was # unix, or krb*, and the user is an author for this domain, @@ -2194,6 +2238,17 @@ sub change_authentication_handler { } ®ister_handler("changeuserauth", \&change_authentication_handler, 1,1, 0); +sub update_passwd_history { + my ($uname,$udom,$umode,$context) = @_; + my $proname=&propath($udom,$uname); + my $now = time; + if (open(my $fh,">>$proname/passwd.log")) { + print $fh "$now:$umode:$context\n"; + close($fh); + } + return; +} + # # Determines if this is the home server for a user. The home server # for a user will have his/her lon-capa passwd file. Therefore all we need @@ -2445,11 +2500,20 @@ sub remove_user_file_handler { if (-e $file) { # # If the file is a regular file unlink is fine... - # However it's possible the client wants a dir. - # removed, in which case rmdir is more approprate: + # However it's possible the client wants a dir + # removed, in which case rmdir is more appropriate + # Note: rmdir will only remove an empty directory. # if (-f $file){ unlink($file); + # for html files remove the associated .bak file + # which may have been created by the editor. + if ($ufile =~ m{^((docs|supplemental)/(?:\d+|default)/\d+(?:|/.+)/)[^/]+\.x?html?$}i) { + my $path = $1; + if (-e $file.'.bak') { + unlink($file.'.bak'); + } + } } elsif(-d $file) { rmdir($file); } @@ -2812,6 +2876,10 @@ sub newput_user_profile_entry { foreach my $pair (@pairs) { my ($key,$value)=split(/=/,$pair); if (exists($hashref->{$key})) { + if (!&untie_user_hash($hashref)) { + &logthis("error: ".($!+0)." untie (GDBM) failed ". + "while attempting newput - early out as key exists"); + } &Failure($client, "key_exists: ".$key."\n",$userinput); return 1; } @@ -3315,6 +3383,9 @@ sub dump_with_regexp { # namespace - Name of the database being modified # rid - Resource keyword to modify. # what - new value associated with rid. +# laststore - (optional) version=timestamp +# for most recent transaction for rid +# in namespace, when cstore was called # # $client - Socket open on the client. # @@ -3323,23 +3394,47 @@ sub dump_with_regexp { # 1 (keep on processing). # Side-Effects: # Writes to the client +# Successful storage will cause either 'ok', or, if $laststore was included +# in the tail of the request, and the version number for the last transaction +# is larger than the version in $laststore, delay:$numtrans , where $numtrans +# is the number of store evevnts recorded for rid in namespace since +# lonnet::store() was called by the client. +# sub store_handler { my ($cmd, $tail, $client) = @_; my $userinput = "$cmd:$tail"; - my ($udom,$uname,$namespace,$rid,$what) =split(/:/,$tail); + chomp($tail); + my ($udom,$uname,$namespace,$rid,$what,$laststore) =split(/:/,$tail); if ($namespace ne 'roles') { - chomp($what); my @pairs=split(/\&/,$what); my $hashref = &tie_user_hash($udom, $uname, $namespace, &GDBM_WRCREAT(), "S", "$rid:$what"); if ($hashref) { my $now = time; - my @previouskeys=split(/&/,$hashref->{"keys:$rid"}); - my $key; + my $numtrans; + if ($laststore) { + my ($previousversion,$previoustime) = split(/\=/,$laststore); + my ($lastversion,$lasttime) = (0,0); + $lastversion = $hashref->{"version:$rid"}; + if ($lastversion) { + $lasttime = $hashref->{"$lastversion:$rid:timestamp"}; + } + if (($previousversion) && ($previousversion !~ /\D/)) { + if (($lastversion > $previousversion) && ($lasttime >= $previoustime)) { + $numtrans = $lastversion - $previousversion; + } + } elsif ($lastversion) { + $numtrans = $lastversion; + } + if ($numtrans) { + $numtrans =~ s/D//g; + } + } + $hashref->{"version:$rid"}++; my $version=$hashref->{"version:$rid"}; my $allkeys=''; @@ -3352,7 +3447,11 @@ sub store_handler { $allkeys.='timestamp'; $hashref->{"$version:keys:$rid"}=$allkeys; if (&untie_user_hash($hashref)) { - &Reply($client, "ok\n", $userinput); + my $msg = 'ok'; + if ($numtrans) { + $msg = 'delay:'.$numtrans; + } + &Reply($client, "$msg\n", $userinput); } else { &Failure($client, "error: ".($!+0)." untie(GDBM) Failed ". "while attempting store\n", $userinput); @@ -5251,7 +5350,9 @@ sub retrieve_auto_file_handler { my ($filename) = split(/:/, $tail); my $source = $perlvar{'lonDaemons'}.'/tmp/'.$filename; - if ( (-e $source) && ($filename ne '') ) { + if ($filename =~m{/\.\./}) { + &Failure($client, "refused\n", $userinput); + } elsif ( (-e $source) && ($filename ne '') ) { my $reply = ''; if (open(my $fh,$source)) { while (<$fh>) { @@ -5359,7 +5460,7 @@ sub crsreq_update_handler { $title,$code,$accessstart,$accessend, $incoming,\%rtnhash); if ($outcome eq 'ok') { - my @posskeys = qw(createdweb createdmsg queuedweb queuedmsg formitems reviewweb); + my @posskeys = qw(createdweb createdmsg createdcustomized createdactions queuedweb queuedmsg formitems reviewweb validationjs onload javascript); foreach my $key (keys(%rtnhash)) { if (grep(/^\Q$key\E/,@posskeys)) { $result .= &escape($key).'='.&Apache::lonnet::freeze_escape($rtnhash{$key}).'&'; @@ -6573,12 +6674,28 @@ sub make_new_child { # my $tmpsnum=0; # Now global #---------------------------------------------------- kerberos 5 initialization &Authen::Krb5::init_context(); - unless (($dist eq 'fedora5') || ($dist eq 'fedora4') || - ($dist eq 'fedora6') || ($dist eq 'suse9.3') || - ($dist eq 'suse12.2') || ($dist eq 'suse12.3') || - ($dist eq 'suse13.1')) { - &Authen::Krb5::init_ets(); - } + + my $no_ets; + if ($dist =~ /^(?:centos|rhes|scientific)(\d+)$/) { + if ($1 >= 7) { + $no_ets = 1; + } + } elsif ($dist =~ /^suse(\d+\.\d+)$/) { + if (($1 eq '9.3') || ($1 >= 12.2)) { + $no_ets = 1; + } + } elsif ($dist =~ /^sles(\d+)$/) { + if ($1 > 11) { + $no_ets = 1; + } + } elsif ($dist =~ /^fedora(\d+)$/) { + if ($1 < 7) { + $no_ets = 1; + } + } + unless ($no_ets) { + &Authen::Krb5::init_ets(); + } &status('Accepted connection'); # ============================================================================= @@ -6961,7 +7078,18 @@ sub validate_user { } if ($howpwd ne 'nouser') { if($howpwd eq "internal") { # Encrypted is in local password file. - $validated = (crypt($password, $contentpwd) eq $contentpwd); + if (length($contentpwd) == 13) { + $validated = (crypt($password,$contentpwd) eq $contentpwd); + if ($validated) { + my $ncpass = &hash_passwd($domain,$password); + if (&rewrite_password_file($domain,$user,"$howpwd:$ncpass")) { + &update_passwd_history($user,$domain,$howpwd,'conversion'); + &logthis("Validated password hashed with bcrypt for $user:$domain"); + } + } + } else { + $validated = &check_internal_passwd($password,$contentpwd,$domain); + } } elsif ($howpwd eq "unix") { # User is a normal unix user. $contentpwd = (getpwnam($user))[1]; @@ -7029,6 +7157,39 @@ sub validate_user { return $validated; } +sub check_internal_passwd { + my ($plainpass,$stored,$domain) = @_; + my (undef,$method,@rest) = split(/!/,$stored); + if ($method eq "bcrypt") { + my $result = &hash_passwd($domain,$plainpass,@rest); + if ($result ne $stored) { + return 0; + } + # Upgrade to a larger number of rounds if necessary + my $defaultcost; + my %domconfig = + &Apache::lonnet::get_dom('configuration',['password'],$domain); + if (ref($domconfig{'password'}) eq 'HASH') { + $defaultcost = $domconfig{'password'}{'cost'}; + } + if (($defaultcost eq '') || ($defaultcost =~ /D/)) { + $defaultcost = 10; + } + return 1 unless($rest[0]<$defaultcost); + } + return 0; +} + +sub get_last_authchg { + my ($domain,$user) = @_; + my $lastmod; + my $logname = &propath($domain,$user).'/passwd.log'; + if (-e "$logname") { + $lastmod = (stat("$logname"))[9]; + } + return $lastmod; +} + sub krb4_authen { my ($password,$null,$user,$contentpwd) = @_; my $validated = 0; @@ -7344,26 +7505,26 @@ sub change_unix_password { sub make_passwd_file { - my ($uname,$udom,$umode,$npass,$passfilename)=@_; + my ($uname,$udom,$umode,$npass,$passfilename,$action)=@_; my $result="ok"; if ($umode eq 'krb4' or $umode eq 'krb5') { { my $pf = IO::File->new(">$passfilename"); if ($pf) { print $pf "$umode:$npass\n"; + &update_passwd_history($uname,$udom,$umode,$action); } else { $result = "pass_file_failed_error"; } } } elsif ($umode eq 'internal') { - my $salt=time; - $salt=substr($salt,6,2); - my $ncpass=crypt($npass,$salt); + my $ncpass = &hash_passwd($udom,$npass); { &Debug("Creating internal auth"); my $pf = IO::File->new(">$passfilename"); if($pf) { print $pf "internal:$ncpass\n"; + &update_passwd_history($uname,$udom,$umode,$action); } else { $result = "pass_file_failed_error"; } @@ -7373,6 +7534,7 @@ sub make_passwd_file { my $pf = IO::File->new(">$passfilename"); if($pf) { print $pf "localauth:$npass\n"; + &update_passwd_history($uname,$udom,$umode,$action); } else { $result = "pass_file_failed_error"; }