{"draftJsState":{"blocks":[{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"6els4"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"В этой статье будут рассматривать, как приложения в Linux могут использовать систему Подключаемых Модулей Безопасности (Pluggable Authentication Modules) для прозрачной аутентификации пользователей.Немного затронем историю развития механизмов аутентификации в Linux, разберемся с системой настроек PAM и разберем исходный код модуля аутентификации pam_p11, который позволяет проводить аутентификацию пользователей по смарт-картам.","type":"unstyled","key":"1ctn7"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"В конце статьи рассмотрим на практике настройку и работу модуля аутентификации в сертифицированном по 3 классу защищенности СВТ и 2 уровню контроля отсутствия недекларированных возможностей дистрибутиве Astra Linux для аутентификации по USB-токенам Рутокен ЭЦП и Рутокен S. Учитывая то, что Рутокен S имеет сертификаты ФСТЭК по НДВ 3, а Рутокен ЭЦП по НДВ 4, это решение может применяться в информационных системах, обрабатывающих конфиденциальную информацию, вплоть до информации с грифом «С».","type":"unstyled","key":"41kme"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"613pc"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":15,"offset":0,"style":"BOLD"}],"text":"Немного истории","type":"unstyled","key":"5bht2"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"f5d6j"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"В старые времена приложению в Linux требовалось запросить аутентификацию пользователя, то ему приходилось обращаться к файлам /etc/passwd и /etc/shadow. Такой подход был прост как пробка, но при этом разработчикам приходилось думать не только о работе с файлами, но и о вопросах безопасности. В связи с этим возникла необходимость разработки прозрачного механизма аутентификации пользователей, не зависящего от способа хранения информации об их учетных записях.","type":"unstyled","key":"691kn"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Решением тому стал проект Linux-PAM. К слову сказать, сама архитектура PAM была впервые предложена компанией Sun в октябре 1995 года, а в августе 1996 года инфраструктура Linux-PAM была включена в дистрибутив Red Hat Linux. В настоящее время существуют три основных реализации PAM:","type":"unstyled","key":"6ctd"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Linux-PAM – основная реализация архитектуры PAM, рассматривается нами в этой статье","type":"unordered-list-item","key":"5hn1m"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"OpenPAM – альтернативная реализация PAM, используемая в BSD-системах и Mac OS X","type":"unordered-list-item","key":"594u0"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Java PAM – Java-обертка над Linux-PAM","type":"ordered-list-item","key":"amiel"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"dint6"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":13,"offset":0,"style":"BOLD"}],"text":"Структура PAM","type":"unstyled","key":"28aeo"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"1bmvh"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Для начала разберемся, что же такое «Модуль PAM». Модули представляют собой библиотеки, в которых прописаны обработчики операций, которые может направлять к ним сам PAM. Для примера, стандартный модуль pam_unix умеет следующее:","type":"unstyled","key":"4q2gc"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"27ds8"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Запросить пароль у пользователя и проверить введенное значение с хранимым в системе","type":"unordered-list-item","key":"5vhg"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Проверить, удовлетворяет ли пароль требованиям безопасности и не истек ли он","type":"unordered-list-item","key":"3vvom"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"a3gpt"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Ниже представлена общая схема работы PAM","type":"unstyled","key":"f79dk"},{"data":{"image":{"id":"650288ac4d91f006086baa24"}},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Общая схема работы PAM","type":"atomic:image","key":"1bjho"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"9nv9"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Сильно упрощенная схема аутентификации в приложении, использующем PAM, выглядит следующим образом:","type":"unstyled","key":"726gq"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Приложение инициализирует библиотеку PAM (libpam.so)","type":"unordered-list-item","key":"8taf1"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"PAM в соответствии с конфигурационным файлом для приложения обращается к требуемым модулям","type":"unordered-list-item","key":"9a370"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Модули выполняют возложенные на них действия","type":"unordered-list-item","key":"fll19"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Приложению возвращается результат операции","type":"unordered-list-item","key":"bob4b"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"9b6id"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Конечно, PAM позволяет проводить не только аутентификацию. Функции PAM классифицируются по типу модулей. В скобках указаны обозначения модулей в конфигурационных файлах:","type":"unstyled","key":"921at"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Аутентификация (auth)","type":"unordered-list-item","key":"8v3al"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Управление учетными записями (account)","type":"unordered-list-item","key":"cjll5"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Управление сеансами (session)","type":"unordered-list-item","key":"arb6b"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Управление паролями (passwd)","type":"unordered-list-item","key":"66er4"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"8me76"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Сейчас нам интересна только аутентификация, поэтому рассмотрение остальных функций оставим любопытству читателя.","type":"unstyled","key":"3tb0l"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"e894u"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":16,"offset":0,"style":"BOLD"}],"text":"Конфигурация PAM","type":"unstyled","key":"48flt"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"f5n58"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Если приложению требуется аутентификация, то оно должно создать файл со своим именем в каталоге /etc/pam.d, в котором должны быть указаны модули, с помощью которых производится аутентификация и прочие действия. Посмотрим, что лежит в каталоге /etc/pam.d в Ubuntu 11.10","type":"unstyled","key":"cpp9e"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"27tgo"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":16,"offset":0,"style":"ITALIC"}],"text":"$ ls /etc/pam.d/","type":"unstyled","key":"a06tg"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":233,"offset":0,"style":"ITALIC"}],"text":"atd common-account common-session-noninteractive lightdm other samba vmtoolsd chfn common-auth cron lightdm-autologin passwd sshd chpasswd common-password cups login polkit-1 su chsh common-session gnome-screensaver newusers ppp sudo","type":"unstyled","key":"15fnh"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"47hel"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Для примера, посмотрим на абстрактный файл конфигурации для приложения login","type":"unstyled","key":"361fo"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"dfna1"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":29,"offset":0,"style":"ITALIC"}],"text":"# PAM configuration for login","type":"unstyled","key":"2bfln"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":31,"offset":0,"style":"ITALIC"}],"text":"auth requisite pam_securetty.so","type":"unstyled","key":"d22kc"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":28,"offset":0,"style":"ITALIC"}],"text":"auth required pam_nologin.so","type":"unstyled","key":"5nv45"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":24,"offset":0,"style":"ITALIC"}],"text":"auth required pam_env.so","type":"unstyled","key":"fbc06"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":32,"offset":0,"style":"ITALIC"}],"text":"auth required pam_unix.so nullok","type":"unstyled","key":"c1f1k"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":28,"offset":0,"style":"ITALIC"}],"text":"account required pam_unix.so","type":"unstyled","key":"esj91"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":28,"offset":0,"style":"ITALIC"}],"text":"session required pam_unix.so","type":"unstyled","key":"8q1q5"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":31,"offset":0,"style":"ITALIC"}],"text":"session optional pam_lastlog.so","type":"unstyled","key":"4kb1e"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":56,"offset":0,"style":"ITALIC"}],"text":"password required pam_unix.so nullok obscure min=4 max=8","type":"unstyled","key":"nn8l"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"bp1ej"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Каждая строчка конфига записывается в виде","type":"unstyled","key":"9bfka"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"<тип модуля>\t<управляющий флаг> <путь к библиотеке> <параметры> ","type":"unordered-list-item","key":"8desg"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"8dph5"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Тип модуля соответствует обозначениям самих модулей (т.е. auth/account/session/passwd)","type":"unordered-list-item","key":"egntr"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Управляющий флаг указывает критичность модуля для успешного выполнения операции. Флаг может принимать следующие значения: requisite (необходимый), required (требуемый), sufficient (достаточный) и optional (необязательный).","type":"unordered-list-item","key":"9b3qr"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Путь к библиотеке задает собственно путь до файла модуля. По умолчанию они ищутся в /lib/security/","type":"unordered-list-item","key":"cttjj"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Параметры задают список аргументов, которые будут переданы модулю. Аргументы передаются аналогично принципу argc/argv в функции main(), за исключением того, что argv[0] содержит не имя модуля, а конкретный аргумент.","type":"unordered-list-item","key":"enm4j"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"evo7h"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Таким образом, мы получаем стек модулей, каждый из которых выполняет свое действие. PAM при этом разбирает стек как и положено – сверху вниз. В соответствии с управляющим флагом задаются следующие требования к успешности операции:","type":"unstyled","key":"bd98v"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"requisite (необходимый): если модуль стека вернет отрицательный ответ, то запрос сразу же отвергается. Другие модули при этом не будут выполнены.","type":"unordered-list-item","key":"2jaa2"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"required (требуемый): если один или несколько модулей стека вернут отрицательный ответ, все остальные модули будут выполнены, но запрос приложения будет отвергнут.","type":"unordered-list-item","key":"32ic7"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"sufficient (достаточный): если модуль помечен как достаточный и перед ним ни один из необходимых или достаточных модулей не возвратил отрицательного ответа, то все оставшиеся модули в стеке игнорируются, и возвращается положительный ответ.","type":"unordered-list-item","key":"484as"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"optional (дополнительный): если в стеке нет требуемых модулей, и если ни один из достаточных модулей не возвратил положительного ответа, то хотя бы один из дополнительных модулей приложения или службы должен вернуть положительный ответ","type":"unordered-list-item","key":"e4es"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"9r1m5"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":36,"offset":41,"style":"ITALIC"}],"text":"Конфигурационные файлы модулей хранятся в /usr/share/pam-configs/<имя модуля>. В каждом файле указывается полное имя модуля, включен ли он по умолчанию, приоритет модуля и параметры аутентификации.","type":"unstyled","key":"9vveo"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"4sa54"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":40,"offset":0,"style":"BOLD"}],"text":"Разработка модуля аутентификации для PAM","type":"unstyled","key":"cdrpe"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"b350g"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"В этом разделе мы разберем исходный код модуля pam_p11 и рассмотрим основные моменты, которым стоит уделить внимание при написании своего собственного модуля.","type":"unstyled","key":"5jm8g"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"89maq"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"pam_p11","type":"unstyled","key":"602pt"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"503dh"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Данный модуль позволяет осуществить двухфакторную аутентификацию пользователей по смарт-картам или USB-токенам с помощью ассиметричной криптографии. Рассмотрим общую схему его работы:","type":"unstyled","key":"4l12u"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"На токене хранится сертификат пользователя и его закрытый ключ","type":"unordered-list-item","key":"ehjrl"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Сертификат также сохранен в домашнем каталоге пользователя как доверенный","type":"unordered-list-item","key":"d83ca"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"589f0"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Аутентификация происходит следующим образом:","type":"unstyled","key":"aus78"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"На токене выполняется поиск сертификата пользователя","type":"unordered-list-item","key":"cqf18"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Через PAM производится запрос PIN-кода к токену","type":"unordered-list-item","key":"1rbd2"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Если аутентификация на токене прошла успешно, то производится подпись случайных данных с помощью закрытого ключа с токена. Сама подпись выполняется аппаратно.","type":"unordered-list-item","key":"5qhbf"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Полученная ЭЦП проверяется с помощью сертификата пользователя","type":"unordered-list-item","key":"99ajv"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"c0njs"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Если в итоге проверка подписи осуществлена успешно, то модуль говорит наружу, что все хорошо.","type":"unstyled","key":"7ucc0"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"В данной схеме используются ключевая пара RSA длины 2048 бит, сгенерированная аппаратно на токене.","type":"unstyled","key":"3hbo9"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"1fg5e"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":17,"offset":1,"style":"BOLD"}],"text":" Разработка модуля","type":"unstyled","key":"87qc"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"7c3fs"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"В зависимости от функционала модуля, PAM может требовать от него наличия следующих функций:","type":"unstyled","key":"8cmvv"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":52,"offset":0,"style":"ITALIC"}],"text":"pam_sm_authenticate, pam_sm_setcred – аутентификация","type":"unstyled","key":"71a9f"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":47,"offset":0,"style":"ITALIC"}],"text":"pam_sm_acct_mgmt – управление учетными записями","type":"unstyled","key":"6c92f"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":38,"offset":0,"style":"ITALIC"}],"text":"pam_sm_chauthtok – управление паролями","type":"unstyled","key":"f8dqd"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":63,"offset":0,"style":"ITALIC"}],"text":"pam_sm_open_session, pam_sm_close_session — управление сеансами","type":"unstyled","key":"a76ek"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"842h7"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Для того чтобы модуль мог выполнять аутентификацию, нам необходимо реализовать в нем функции pam_sm_authenticate и pam_sm_setcred. В остальных функциях достаточно просто добавить заглушки, чтобы наш модуль нельзя было использовать для других операций.","type":"unstyled","key":"cta55"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Для работы с PAM необходимо определить специальные константы, а только затем подключить заголовочные файлы:","type":"unstyled","key":"69cf6"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"a0mo8"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":19,"offset":0,"style":"ITALIC"}],"text":"#define PAM_SM_AUTH","type":"unstyled","key":"16n1n"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":22,"offset":0,"style":"ITALIC"}],"text":"#define PAM_SM_ACCOUNT","type":"unstyled","key":"dlqga"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":22,"offset":0,"style":"ITALIC"}],"text":"#define PAM_SM_SESSION","type":"unstyled","key":"29gvb"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":23,"offset":0,"style":"ITALIC"}],"text":"#define PAM_SM_PASSWORD","type":"unstyled","key":"84ppo"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":30,"offset":0,"style":"ITALIC"}],"text":"#include ","type":"unstyled","key":"4ejt7"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":33,"offset":0,"style":"ITALIC"}],"text":"#include ","type":"unstyled","key":"adb7"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"aik7f"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Эти константы необходимы, чтобы PAM знал, что наш модуль может выполнять все функции, описанные выше. Конечно, если мы реализуем только аутентификацию, то остальные функции можно отбросить, но разработчики pam_p11 решили, что надежнее будет поставить заглушки вместо неиспользуемых функций.","type":"unstyled","key":"eeg64"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Приступим к написанию функции pam_sm_authenticate. Она имеет следующую сигнатуру:","type":"unstyled","key":"3s6es"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"fbubg"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":95,"offset":0,"style":"ITALIC"}],"text":"PAM_EXTERN int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const char **argv);","type":"unstyled","key":"f71le"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"e07f1"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Из важных параметров тут стоит отметить:","type":"unstyled","key":"euv9j"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"pamh – хендл к PAM, полученный приложением","type":"unordered-list-item","key":"964al"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"argc, argv – аргументы, указанные в конфигурационном файле. Наш модуль принимает один аргумент – путь к библиотеке PKCS#11","type":"unordered-list-item","key":"abp3j"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"107je"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Функция должна вернуть одно из следующих значений:","type":"unstyled","key":"580dj"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"PAM_AUTH_ERR – ошибка аутентификации","type":"unordered-list-item","key":"82uab"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"PAM_CRED_INSUFFICIENT – у приложения недостаточно прав для выполнения аутентификации","type":"unordered-list-item","key":"cvtme"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"PAM_AUTHINFO_UNAVAIL – модулю не удалось получить информацию для выполнения аутентификации. Это может случиться из-за проблем в сети или другого отказа оборудования","type":"unordered-list-item","key":"dndj4"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"PAM_SUCCESS – аутентификация прошла успешно","type":"unordered-list-item","key":"3jejs"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"PAM_USER_UNKNOWN – пользователь с переданным именем не существует","type":"unordered-list-item","key":"fs14g"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"PAM_MAXTRIES – один или несколько модулей аутентификации превысили допустимый предел попыток.","type":"unordered-list-item","key":"5phmf"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"c4c9g"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Внутри нашего модуля мы будем пользоваться библиотекой libp11 для работы с API PKCS#11 и OpenSSL для работы с сертификатами.","type":"unstyled","key":"5knc7"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Первым делом определим переменные, которые нам потребуются:","type":"unstyled","key":"9jnko"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"eamr2"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":10,"offset":0,"style":"ITALIC"}],"text":"int i, rv;","type":"unstyled","key":"4mkqq"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":37,"offset":0,"style":"ITALIC"}],"text":"const char *user; // имя пользователя","type":"unstyled","key":"301gb"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":48,"offset":0,"style":"ITALIC"}],"text":"char *password; // вводимый пользователем пароль","type":"unstyled","key":"3ngfa"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":76,"offset":0,"style":"ITALIC"}],"text":"char password_prompt[64]; // запрос на ввод пароля, показываемый приложением","type":"unstyled","key":"b6mlf"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":16,"offset":0,"style":"ITALIC"}],"text":"// структуры PAM","type":"unstyled","key":"3a13t"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":45,"offset":0,"style":"ITALIC"}],"text":"struct pam_conv *conv; // функция диалога PAM","type":"unstyled","key":"23r13"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":48,"offset":0,"style":"ITALIC"}],"text":"struct pam_message msg; // сообщения диалога PAM","type":"unstyled","key":"47h4c"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":30,"offset":0,"style":"ITALIC"}],"text":"struct pam_message *(msgp[1]);","type":"unstyled","key":"2lg8s"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":39,"offset":0,"style":"ITALIC"}],"text":"struct pam_response *resp; // ответ PAM","type":"unstyled","key":"4vu5g"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"6ojka"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":21,"offset":0,"style":"ITALIC"}],"text":"// структуры lib_p11:","type":"unstyled","key":"f5bgt"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":36,"offset":0,"style":"ITALIC"}],"text":"PKCS11_CTX *ctx; // контекст PKCS#11","type":"unstyled","key":"8f4k6"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":35,"offset":0,"style":"ITALIC"}],"text":"PKCS11_SLOT *slot, *slots; // слоты","type":"unstyled","key":"18kei"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":34,"offset":0,"style":"ITALIC"}],"text":"PKCS11_CERT *certs; // сертификаты","type":"unstyled","key":"312uf"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":28,"offset":0,"style":"ITALIC"}],"text":"unsigned int nslots, ncerts;","type":"unstyled","key":"502ve"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":37,"offset":0,"style":"ITALIC"}],"text":"PKCS11_KEY *authkey; // закрытый ключ","type":"unstyled","key":"bntj1"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":36,"offset":0,"style":"ITALIC"}],"text":"PKCS11_CERT *authcert; // сертификат","type":"unstyled","key":"fshu4"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"9fjhf"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":63,"offset":0,"style":"ITALIC"}],"text":"EVP_PKEY *pubkey; // открытый ключ OpenSSL для проверки подписи","type":"unstyled","key":"cmq4n"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"f224"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":38,"offset":0,"style":"ITALIC"}],"text":"unsigned char rand_bytes[RANDOM_SIZE];","type":"unstyled","key":"pe27"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":37,"offset":0,"style":"ITALIC"}],"text":"unsigned char signature[MAX_SIGSIZE];","type":"unstyled","key":"8fi65"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":7,"offset":0,"style":"ITALIC"}],"text":"int fd;","type":"unstyled","key":"9nrhe"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":16,"offset":0,"style":"ITALIC"}],"text":"unsigned siglen;","type":"unstyled","key":"9lkm9"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"4i5eu"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Затем проверим, передали ли нам путь к библиотеке PKCS#11","type":"unstyled","key":"d6eb"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"41kto"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":16,"offset":0,"style":"ITALIC"}],"text":"if (argc != 1) {","type":"unstyled","key":"3cvfo"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":61,"offset":0,"style":"ITALIC"}],"text":"\tpam_syslog(pamh, LOG_ERR, \"need pkcs11 module as argument\");","type":"unstyled","key":"eb0sf"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":18,"offset":0,"style":"ITALIC"}],"text":"\treturn PAM_ABORT;","type":"unstyled","key":"5ms9j"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":1,"offset":0,"style":"ITALIC"}],"text":"}","type":"unstyled","key":"feaqa"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"eul36"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"После чего инициализируем OpenSSL и контекст PKCS#11","type":"unstyled","key":"2kai8"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"3ms5h"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":29,"offset":0,"style":"ITALIC"}],"text":"OpenSSL_add_all_algorithms();","type":"unstyled","key":"1sghs"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":26,"offset":0,"style":"ITALIC"}],"text":"ERR_load_crypto_strings();","type":"unstyled","key":"87k5n"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":23,"offset":0,"style":"ITALIC"}],"text":"ctx = PKCS11_CTX_new();","type":"unstyled","key":"f44mo"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"1pgla"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Запросим у PAM имя пользователя","type":"unstyled","key":"cg5na"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"bqdum"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":37,"offset":0,"style":"ITALIC"}],"text":"rv = pam_get_user(pamh, &user, NULL);","type":"unstyled","key":"abdf7"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":24,"offset":0,"style":"ITALIC"}],"text":"if (rv != PAM_SUCCESS) {","type":"unstyled","key":"7474q"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":79,"offset":0,"style":"ITALIC"}],"text":"\tpam_syslog(pamh, LOG_ERR, \"pam_get_user() failed %s\", pam_strerror(pamh, rv));","type":"unstyled","key":"80rnc"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":25,"offset":0,"style":"ITALIC"}],"text":"\treturn PAM_USER_UNKNOWN;","type":"unstyled","key":"1542n"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":1,"offset":0,"style":"ITALIC"}],"text":"}","type":"unstyled","key":"s72v"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"ccuin"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Теперь загрузим библиотеку PKCS#11, найдем первый доступный токен и получим с него сертификаты","type":"unstyled","key":"3cg3p"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"5qlgb"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":35,"offset":0,"style":"ITALIC"}],"text":"rv = PKCS11_CTX_load(ctx, argv[0]);","type":"unstyled","key":"94kuv"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":9,"offset":0,"style":"ITALIC"}],"text":"if (rv) {","type":"unstyled","key":"8jdp2"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":59,"offset":0,"style":"ITALIC"}],"text":"\tpam_syslog(pamh, LOG_ERR, \"loading pkcs11 engine failed\");","type":"unstyled","key":"7ob64"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":29,"offset":0,"style":"ITALIC"}],"text":"\treturn PAM_AUTHINFO_UNAVAIL;","type":"unstyled","key":"9rlse"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":1,"offset":0,"style":"ITALIC"}],"text":"}","type":"unstyled","key":"d69ks"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":38,"offset":0,"style":"ITALIC"}],"text":"// получим все доступные слоты PKCS#11","type":"unstyled","key":"509rc"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":50,"offset":0,"style":"ITALIC"}],"text":"rv = PKCS11_enumerate_slots(ctx, &slots, &nslots);","type":"unstyled","key":"8o8ug"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":9,"offset":0,"style":"ITALIC"}],"text":"if (rv) {","type":"unstyled","key":"44phv"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":51,"offset":0,"style":"ITALIC"}],"text":"\tpam_syslog(pamh, LOG_ERR, \"listing slots failed\");","type":"unstyled","key":"890cv"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":29,"offset":0,"style":"ITALIC"}],"text":"\treturn PAM_AUTHINFO_UNAVAIL;","type":"unstyled","key":"akl06"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":1,"offset":0,"style":"ITALIC"}],"text":"}","type":"unstyled","key":"9v40f"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":31,"offset":0,"style":"ITALIC"}],"text":"// найдем первый слот с токеном","type":"unstyled","key":"afsk9"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":45,"offset":0,"style":"ITALIC"}],"text":"slot = PKCS11_find_token(ctx, slots, nslots);","type":"unstyled","key":"b1367"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":28,"offset":0,"style":"ITALIC"}],"text":"if (!slot || !slot->token) {","type":"unstyled","key":"ejhdj"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":49,"offset":0,"style":"ITALIC"}],"text":"\tpam_syslog(pamh, LOG_ERR, \"no token available\");","type":"unstyled","key":"9mgop"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":27,"offset":0,"style":"ITALIC"}],"text":"\trv = PAM_AUTHINFO_UNAVAIL;","type":"unstyled","key":"2qb40"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":10,"offset":0,"style":"ITALIC"}],"text":"\tgoto out;","type":"unstyled","key":"6jma1"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":1,"offset":0,"style":"ITALIC"}],"text":"}","type":"unstyled","key":"fa443"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":31,"offset":0,"style":"ITALIC"}],"text":"// получим сертификаты с токена","type":"unstyled","key":"92aku"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":58,"offset":0,"style":"ITALIC"}],"text":"rv = PKCS11_enumerate_certs(slot->token, &certs, &ncerts);","type":"unstyled","key":"43m8u"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":9,"offset":0,"style":"ITALIC"}],"text":"if (rv) {","type":"unstyled","key":"d5tp6"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":60,"offset":0,"style":"ITALIC"}],"text":"\tpam_syslog(pamh, LOG_ERR, \"PKCS11_enumerate_certs failed\");","type":"unstyled","key":"1f7ch"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":27,"offset":0,"style":"ITALIC"}],"text":"\trv = PAM_AUTHINFO_UNAVAIL;","type":"unstyled","key":"dm8n6"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":10,"offset":0,"style":"ITALIC"}],"text":"\tgoto out;","type":"unstyled","key":"2bt49"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":1,"offset":0,"style":"ITALIC"}],"text":"}","type":"unstyled","key":"2oac9"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":18,"offset":0,"style":"ITALIC"}],"text":"if (ncerts <= 0) {","type":"unstyled","key":"5a88g"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":52,"offset":0,"style":"ITALIC"}],"text":"\tpam_syslog(pamh, LOG_ERR, \"no certificates found\");","type":"unstyled","key":"9do39"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":27,"offset":0,"style":"ITALIC"}],"text":"\trv = PAM_AUTHINFO_UNAVAIL;","type":"unstyled","key":"51pt5"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":10,"offset":0,"style":"ITALIC"}],"text":"\tgoto out;","type":"unstyled","key":"4diuh"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":1,"offset":0,"style":"ITALIC"}],"text":"}","type":"unstyled","key":"2gm4e"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"9bvdp"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Теперь среди сертификатов на токене найдем тот, что лежит у нас в ~/.eid/authorized_certificates:","type":"unstyled","key":"6j6l1"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"bqq1m"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":30,"offset":0,"style":"ITALIC"}],"text":"for (i = 0; i < ncerts; i++) {","type":"unstyled","key":"9kd9s"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":22,"offset":0,"style":"ITALIC"}],"text":"\tauthcert = &certs[i];","type":"unstyled","key":"5q26a"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":24,"offset":0,"style":"ITALIC"}],"text":"\tif (authcert != NULL) {","type":"unstyled","key":"cph96"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":73,"offset":0,"style":"ITALIC"}],"text":"\t\t/* проверим, совпадает ли сертификат с введенным именем пользователя */","type":"unstyled","key":"7drrd"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":40,"offset":0,"style":"ITALIC"}],"text":"\t\trv = match_user(authcert->x509, user);","type":"unstyled","key":"2i53l"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":15,"offset":0,"style":"ITALIC"}],"text":"\t\tif (rv < 0) {","type":"unstyled","key":"7ilck"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":52,"offset":0,"style":"ITALIC"}],"text":"\t\t\tpam_syslog(pamh, LOG_ERR, \"match_user() failed\");","type":"unstyled","key":"5td7e"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":29,"offset":0,"style":"ITALIC"}],"text":"\t\t\trv = PAM_AUTHINFO_UNAVAIL;","type":"unstyled","key":"ealet"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":12,"offset":0,"style":"ITALIC"}],"text":"\t\t\tgoto out;","type":"unstyled","key":"dktki"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":23,"offset":0,"style":"ITALIC"}],"text":"\t\t} else if (rv == 0) {","type":"unstyled","key":"1r11i"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":48,"offset":0,"style":"ITALIC"}],"text":"\t\t\t/* this is not the cert we are looking for */","type":"unstyled","key":"4h7m5"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":19,"offset":0,"style":"ITALIC"}],"text":"\t\t\tauthcert = NULL;","type":"unstyled","key":"1oaeg"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":10,"offset":0,"style":"ITALIC"}],"text":"\t\t} else {","type":"unstyled","key":"2htfq"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":9,"offset":0,"style":"ITALIC"}],"text":"\t\t\tbreak;","type":"unstyled","key":"7noe4"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":3,"offset":0,"style":"ITALIC"}],"text":"\t\t}","type":"unstyled","key":"7sgd2"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":2,"offset":0,"style":"ITALIC"}],"text":"\t}","type":"unstyled","key":"dfosj"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":1,"offset":0,"style":"ITALIC"}],"text":"}","type":"unstyled","key":"43r8j"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":16,"offset":0,"style":"ITALIC"}],"text":"if (!authcert) {","type":"unstyled","key":"chf5g"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":61,"offset":0,"style":"ITALIC"}],"text":"\tpam_syslog(pamh, LOG_ERR, \"no matching certificates found\");","type":"unstyled","key":"1fg61"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":27,"offset":0,"style":"ITALIC"}],"text":"\trv = PAM_AUTHINFO_UNAVAIL;","type":"unstyled","key":"2osul"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":10,"offset":0,"style":"ITALIC"}],"text":"\tgoto out;","type":"unstyled","key":"5sp0s"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":1,"offset":0,"style":"ITALIC"}],"text":"}","type":"unstyled","key":"971v1"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"96fmk"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"А сейчас самое интересное – нам нужно запросить через PAM пароль пользователя (который в нашем случае будет PIN-кодом к токену), а затем выполнить аутентификацию на токен","type":"unstyled","key":"5h01g"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"dpc3s"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":79,"offset":0,"style":"ITALIC"}],"text":"// для начала проверим, не сохранил ли PAM пароль при выполнении других модулей","type":"unstyled","key":"1hoal"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":56,"offset":0,"style":"ITALIC"}],"text":"rv = pam_get_item(pamh, PAM_AUTHTOK, (void *)&password);","type":"unstyled","key":"1s8q9"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":36,"offset":0,"style":"ITALIC"}],"text":"if (rv == PAM_SUCCESS && password) {","type":"unstyled","key":"95jil"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":29,"offset":0,"style":"ITALIC"}],"text":"\tpassword = strdup(password);","type":"unstyled","key":"44njb"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":8,"offset":0,"style":"ITALIC"}],"text":"} else {","type":"unstyled","key":"6vimr"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":58,"offset":0,"style":"ITALIC"}],"text":"\t// если пароль не сохранен, то спросим его у пользователя","type":"unstyled","key":"aqped"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":76,"offset":0,"style":"ITALIC"}],"text":"\tsprintf(password_prompt, \"Password for token %.32s: \", slot->token->label);","type":"unstyled","key":"bbft8"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":73,"offset":0,"style":"ITALIC"}],"text":"\t// задаем параметры диалога PAM: запрос пароля без рисования \"звездочек\"","type":"unstyled","key":"drv43"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":37,"offset":0,"style":"ITALIC"}],"text":"\tmsg.msg_style = PAM_PROMPT_ECHO_OFF;","type":"unstyled","key":"5s5r6"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":27,"offset":0,"style":"ITALIC"}],"text":"\tmsg.msg = password_prompt;","type":"unstyled","key":"eploq"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":47,"offset":0,"style":"ITALIC"}],"text":"\t// получаем указатель на структуру диалога PAM","type":"unstyled","key":"3et5r"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":57,"offset":0,"style":"ITALIC"}],"text":"\trv = pam_get_item(pamh, PAM_CONV, (const void **)&conv);","type":"unstyled","key":"5dhtp"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":25,"offset":0,"style":"ITALIC"}],"text":"\tif (rv != PAM_SUCCESS) {","type":"unstyled","key":"dejup"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":28,"offset":0,"style":"ITALIC"}],"text":"\t\trv = PAM_AUTHINFO_UNAVAIL;","type":"unstyled","key":"79l8k"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":11,"offset":0,"style":"ITALIC"}],"text":"\t\tgoto out;","type":"unstyled","key":"ege1q"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":2,"offset":0,"style":"ITALIC"}],"text":"\t}","type":"unstyled","key":"9pa00"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":46,"offset":0,"style":"ITALIC"}],"text":"\tif ((conv == NULL) || (conv->conv == NULL)) {","type":"unstyled","key":"ftv19"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":28,"offset":0,"style":"ITALIC"}],"text":"\t\trv = PAM_AUTHINFO_UNAVAIL;","type":"unstyled","key":"1go4k"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":11,"offset":0,"style":"ITALIC"}],"text":"\t\tgoto out;","type":"unstyled","key":"6svaj"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":2,"offset":0,"style":"ITALIC"}],"text":"\t}","type":"unstyled","key":"80hrr"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":67,"offset":0,"style":"ITALIC"}],"text":"\t// вызываем функцию диалога, введенный пароль будет записан в resp","type":"unstyled","key":"emreq"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":81,"offset":0,"style":"ITALIC"}],"text":"\trv = conv->conv(1, (const struct pam_message **)msgp, &resp, conv->appdata_ptr);","type":"unstyled","key":"baotv"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":25,"offset":0,"style":"ITALIC"}],"text":"\tif (rv != PAM_SUCCESS) {","type":"unstyled","key":"7o1tk"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":28,"offset":0,"style":"ITALIC"}],"text":"\t\trv = PAM_AUTHINFO_UNAVAIL;","type":"unstyled","key":"f9gp"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":11,"offset":0,"style":"ITALIC"}],"text":"\t\tgoto out;","type":"unstyled","key":"fhg6p"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":2,"offset":0,"style":"ITALIC"}],"text":"\t}","type":"unstyled","key":"c41cu"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":48,"offset":0,"style":"ITALIC"}],"text":"\tif ((resp == NULL) || (resp[0].resp == NULL)) {","type":"unstyled","key":"3s94a"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":28,"offset":0,"style":"ITALIC"}],"text":"\t\trv = PAM_AUTHINFO_UNAVAIL;","type":"unstyled","key":"4g78h"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":11,"offset":0,"style":"ITALIC"}],"text":"\t\tgoto out;","type":"unstyled","key":"2mmdi"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":2,"offset":0,"style":"ITALIC"}],"text":"\t}","type":"unstyled","key":"djvcj"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":45,"offset":0,"style":"ITALIC"}],"text":"\t// запоминаем пароль и очищаем память ответа","type":"unstyled","key":"2nej"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":33,"offset":0,"style":"ITALIC"}],"text":"\tpassword = strdup(resp[0].resp);","type":"unstyled","key":"fs77c"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":47,"offset":0,"style":"ITALIC"}],"text":"\tmemset(resp[0].resp, 0, strlen(resp[0].resp));","type":"unstyled","key":"7a8or"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":16,"offset":0,"style":"ITALIC"}],"text":"\tfree(&resp[0]);","type":"unstyled","key":"ea7js"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":1,"offset":0,"style":"ITALIC"}],"text":"}","type":"unstyled","key":"d7eee"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"7iofg"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Теперь мы можем выполнить аутентификацию на токене:","type":"unstyled","key":"2t4ln"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"58jf6"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":37,"offset":0,"style":"ITALIC"}],"text":"rv = PKCS11_login(slot, 0, password);","type":"unstyled","key":"8jdir"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":53,"offset":0,"style":"ITALIC"}],"text":"// не забываем очистить память, выделенную под пароль","type":"unstyled","key":"c26da"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":38,"offset":0,"style":"ITALIC"}],"text":"memset(password, 0, strlen(password));","type":"unstyled","key":"6k4u0"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":15,"offset":0,"style":"ITALIC"}],"text":"free(password);","type":"unstyled","key":"4e8sj"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":14,"offset":0,"style":"ITALIC"}],"text":"if (rv != 0) {","type":"unstyled","key":"e3b8b"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":50,"offset":0,"style":"ITALIC"}],"text":"\tpam_syslog(pamh, LOG_ERR, \"PKCS11_login failed\");","type":"unstyled","key":"1f2i7"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":27,"offset":0,"style":"ITALIC"}],"text":"\trv = PAM_AUTHINFO_UNAVAIL;","type":"unstyled","key":"bed26"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":10,"offset":0,"style":"ITALIC"}],"text":"\tgoto out;","type":"unstyled","key":"c2f20"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":1,"offset":0,"style":"ITALIC"}],"text":"}","type":"unstyled","key":"73fc8"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"79t31"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"На этом завершается первый этап аутентификации. Теперь нам нужно проверить, обладает ли владелец токена закрытым ключом. Для этого вычислим ЭЦП для произвольного блока данных и проверим ее с помощью доверенного сертификата.","type":"unstyled","key":"7lvrc"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Для начала считаем 128 байт из /dev/random","type":"unstyled","key":"p84a"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"3d2pu"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":35,"offset":0,"style":"ITALIC"}],"text":"fd = open(RANDOM_SOURCE, O_RDONLY);","type":"unstyled","key":"14cka"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":13,"offset":0,"style":"ITALIC"}],"text":"if (fd < 0) {","type":"unstyled","key":"b08sl"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":65,"offset":0,"style":"ITALIC"}],"text":"\tpam_syslog(pamh, LOG_ERR, \"fatal: cannot open RANDOM_SOURCE: \");","type":"unstyled","key":"5qjnr"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":27,"offset":0,"style":"ITALIC"}],"text":"\trv = PAM_AUTHINFO_UNAVAIL;","type":"unstyled","key":"a5jms"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":10,"offset":0,"style":"ITALIC"}],"text":"\tgoto out;","type":"unstyled","key":"fm9qg"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":1,"offset":0,"style":"ITALIC"}],"text":"}","type":"unstyled","key":"c3p0h"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":39,"offset":0,"style":"ITALIC"}],"text":"rv = read(fd, rand_bytes, RANDOM_SIZE);","type":"unstyled","key":"fnmlt"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":13,"offset":0,"style":"ITALIC"}],"text":"if (rv < 0) {","type":"unstyled","key":"1gmqi"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":70,"offset":0,"style":"ITALIC"}],"text":"\tpam_syslog(pamh, LOG_ERR, \"fatal: read from random source failed: \");","type":"unstyled","key":"dq6dm"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":11,"offset":0,"style":"ITALIC"}],"text":"\tclose(fd);","type":"unstyled","key":"dv58g"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":27,"offset":0,"style":"ITALIC"}],"text":"\trv = PAM_AUTHINFO_UNAVAIL;","type":"unstyled","key":"cnlhl"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":10,"offset":0,"style":"ITALIC"}],"text":"\tgoto out;","type":"unstyled","key":"cov2e"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":1,"offset":0,"style":"ITALIC"}],"text":"}","type":"unstyled","key":"1750d"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"cvng6"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":23,"offset":0,"style":"ITALIC"}],"text":"if (rv < RANDOM_SIZE) {","type":"unstyled","key":"auki8"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":92,"offset":0,"style":"ITALIC"}],"text":"\tpam_syslog(pamh, LOG_ERR, \"fatal: read returned less than %d<%d bytes\\n\", rv, RANDOM_SIZE);","type":"unstyled","key":"4lncq"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":11,"offset":0,"style":"ITALIC"}],"text":"\tclose(fd);","type":"unstyled","key":"4ac43"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":27,"offset":0,"style":"ITALIC"}],"text":"\trv = PAM_AUTHINFO_UNAVAIL;","type":"unstyled","key":"ero1l"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":10,"offset":0,"style":"ITALIC"}],"text":"\tgoto out;","type":"unstyled","key":"5kjgp"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":1,"offset":0,"style":"ITALIC"}],"text":"}","type":"unstyled","key":"clqks"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":10,"offset":0,"style":"ITALIC"}],"text":"close(fd);","type":"unstyled","key":"1i50h"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"6kj6l"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Затем получим закрытый ключ, соответствующий сертификату и подпишем на нем случайные данные","type":"unstyled","key":"9bgrv"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"8ga6u"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":39,"offset":0,"style":"ITALIC"}],"text":"// поиск закрытого ключа по сертификату","type":"unstyled","key":"6ium0"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":36,"offset":0,"style":"ITALIC"}],"text":"authkey = PKCS11_find_key(authcert);","type":"unstyled","key":"6koll"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":15,"offset":0,"style":"ITALIC"}],"text":"if (!authkey) {","type":"unstyled","key":"5j48"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":68,"offset":0,"style":"ITALIC"}],"text":"\tpam_syslog(pamh, LOG_ERR, \"no key matching certificate available\");","type":"unstyled","key":"tma4"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":27,"offset":0,"style":"ITALIC"}],"text":"\trv = PAM_AUTHINFO_UNAVAIL;","type":"unstyled","key":"ar2d5"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":10,"offset":0,"style":"ITALIC"}],"text":"\tgoto out;","type":"unstyled","key":"6pqj5"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":1,"offset":0,"style":"ITALIC"}],"text":"}","type":"unstyled","key":"212ab"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":28,"offset":0,"style":"ITALIC"}],"text":"// аппаратное вычисление ЭЦП","type":"unstyled","key":"72qo6"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":21,"offset":0,"style":"ITALIC"}],"text":"siglen = MAX_SIGSIZE;","type":"unstyled","key":"dp4tl"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":81,"offset":0,"style":"ITALIC"}],"text":"rv = PKCS11_sign(NID_sha1, rand_bytes, RANDOM_SIZE, signature, &siglen, authkey);","type":"unstyled","key":"7b657"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":14,"offset":0,"style":"ITALIC"}],"text":"if (rv != 1) {","type":"unstyled","key":"bq8qc"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":58,"offset":0,"style":"ITALIC"}],"text":"\tpam_syslog(pamh, LOG_ERR, \"fatal: pkcs11_sign failed\\n\");","type":"unstyled","key":"bobgk"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":27,"offset":0,"style":"ITALIC"}],"text":"\trv = PAM_AUTHINFO_UNAVAIL;","type":"unstyled","key":"ep8kh"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":10,"offset":0,"style":"ITALIC"}],"text":"\tgoto out;","type":"unstyled","key":"57cpu"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":1,"offset":0,"style":"ITALIC"}],"text":"}","type":"unstyled","key":"2870t"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"12peu"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Проверим подпись. Для этого сначала средствами OpenSSL получим открытый ключ из сертификата, а затем выполним проверку ЭЦП","type":"unstyled","key":"bapsp"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"cn08o"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":41,"offset":0,"style":"ITALIC"}],"text":"pubkey = X509_get_pubkey(authcert->x509);","type":"unstyled","key":"d46vn"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":21,"offset":0,"style":"ITALIC"}],"text":"if (pubkey == NULL) {","type":"unstyled","key":"4se26"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":59,"offset":0,"style":"ITALIC"}],"text":"\tpam_syslog(pamh, LOG_ERR, \"could not extract public key\");","type":"unstyled","key":"9trh6"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":27,"offset":0,"style":"ITALIC"}],"text":"\trv = PAM_AUTHINFO_UNAVAIL;","type":"unstyled","key":"1u4m9"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":10,"offset":0,"style":"ITALIC"}],"text":"\tgoto out;","type":"unstyled","key":"9rf3m"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":1,"offset":0,"style":"ITALIC"}],"text":"}","type":"unstyled","key":"7hlgt"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":45,"offset":0,"style":"ITALIC"}],"text":"// программно проверяем ЭЦП с помощью OpenSSL","type":"unstyled","key":"5pn9p"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":88,"offset":0,"style":"ITALIC"}],"text":"rv = RSA_verify(NID_sha1, rand_bytes, RANDOM_SIZE, signature, siglen, pubkey->pkey.rsa);","type":"unstyled","key":"c8cpn"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":14,"offset":0,"style":"ITALIC"}],"text":"if (rv != 1) {","type":"unstyled","key":"fafft"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":57,"offset":0,"style":"ITALIC"}],"text":"\tpam_syslog(pamh, LOG_ERR, \"fatal: RSA_verify failed\\n\");","type":"unstyled","key":"adf01"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":27,"offset":0,"style":"ITALIC"}],"text":"\trv = PAM_AUTHINFO_UNAVAIL;","type":"unstyled","key":"35cvg"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":10,"offset":0,"style":"ITALIC"}],"text":"\tgoto out;","type":"unstyled","key":"32m65"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":1,"offset":0,"style":"ITALIC"}],"text":"}","type":"unstyled","key":"b5qnb"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"fooj4"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Если проверка подписи прошла успешно, то мы можем завершить работу с библиотекой PKCS#11 и вернуть PAM_SUCCESS.","type":"unstyled","key":"bebu9"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"70ddq"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":17,"offset":1,"style":"ITALIC"}],"text":"\trv = PAM_SUCCESS;","type":"unstyled","key":"u27h"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":4,"offset":0,"style":"ITALIC"}],"text":"out:","type":"unstyled","key":"996l7"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":46,"offset":0,"style":"ITALIC"}],"text":"\tPKCS11_release_all_slots(ctx, slots, nslots);","type":"unstyled","key":"4umqn"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":24,"offset":0,"style":"ITALIC"}],"text":"\tPKCS11_CTX_unload(ctx);","type":"unstyled","key":"g1qb"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":22,"offset":0,"style":"ITALIC"}],"text":"\tPKCS11_CTX_free(ctx);","type":"unstyled","key":"7gjp4"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":11,"offset":0,"style":"ITALIC"}],"text":"\treturn rv;","type":"unstyled","key":"4u826"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"34asi"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Вместо остальных функций оставим никому не интересные заглушки, соберем модуль и приступим к его настройке и использованию.","type":"unstyled","key":"9smet"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"8aosa"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":26,"offset":0,"style":"BOLD"}],"text":"Практическое использование","type":"unstyled","key":"ejfe5"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"altll"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"В качестве подопытного дистрибутива можно было бы взять свежую Ubuntu, но учитывая то, что в 12.04 все слишком хорошо работает, мы решили с пользой для общего дела настроить аутентификацию в релизе «Смоленск» операционной системы Astra Linux Special Edition по USB-токенам Рутокен ЭЦП и Рутокен S.","type":"unstyled","key":"f0fbd"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"4mic4"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":32,"offset":0,"style":"BOLD"}],"text":"Установка дополнительных пакетов","type":"unstyled","key":"an45i"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"dv3hm"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Для начала пришлось установить некоторые пакеты. Для работы Рутокен S необходима старая версия OpenSC: 0.11.13, а для работы Рутокен ЭЦП – более новая: 0.12.2. В качестве middleware для обоих токенов используется OpenCT версии 0.6.20.","type":"unstyled","key":"a05en"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"В итоге были поставлены пакеты, переданные разработчиками дистрибутива:","type":"unstyled","key":"8o35h"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"1v41o"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"libopenct1 (0.6.20-1.2): ","type":"unstyled","key":"evivi"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":31,"offset":0,"style":"ITALIC"}],"text":"libopenct1_0.6.20-1.2_amd64.deb","type":"unstyled","key":"f5c4k"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"openct (0.6.20-1.2): ","type":"unstyled","key":"f3evh"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":27,"offset":0,"style":"ITALIC"}],"text":"openct_0.6.20-1.2_amd64.deb","type":"unstyled","key":"js5s"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"58m6t"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Для Рутокен S","type":"unstyled","key":"b7383"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"439ht"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"libopensc2_0.11.13-1.1_amd64.deb","type":"unstyled","key":"6v8pp"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"opensc_0.11.13-1.1_amd64.deb","type":"unstyled","key":"8gjs1"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"mozilla-opensc_0.11.13-1.1_amd64.deb","type":"unstyled","key":"1l6pv"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"eimu0"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Для Рутокен ЭЦП","type":"unstyled","key":"d34g8"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"8ijd1"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"opensc (0.12.2-2): opensc_0.12.2-2_amd64.deb","type":"unstyled","key":"ffree"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"auaop"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"При установке новой версии opensc потребовалось удовлетворить зависимости пакетов. Для этого были взяты следующие пакеты из репозитория Debian squeeze:","type":"unstyled","key":"1lede"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"euq3u"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"libltdl7 (>= 2.2.6b): libltdl7_2.2.6b-2_amd64.deb","type":"unstyled","key":"4j9ir"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"libssl0.9.8 (>= 0.9.8m-1): libssl0.9.8_0.9.8o-4squeeze11_amd64.deb","type":"unstyled","key":"2fshh"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"ek59r"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":28,"offset":0,"style":"BOLD"}],"text":"Модуль PAM и его зависимости","type":"unstyled","key":"90neq"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"eql6r"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Для осуществления аутентификации по токену были установлены пакеты:","type":"unstyled","key":"fhl0v"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"libp11-1 (0.2.7-2): libp11-1_0.2.7-2_amd64.deb","type":"unstyled","key":"2p4is"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"libpam-p11 (0.1.5-1): libpam-p11_0.1.5-1+b1_amd64.deb","type":"unstyled","key":"ckf64"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"libengine-pkcs11-openssl (0.1.8-2): libengine-pkcs11-openssl_0.1.8-2_amd64.deb","type":"unstyled","key":"bfq06"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"7du9a"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":17,"offset":0,"style":"BOLD"}],"text":"Настройка pam_p11","type":"unstyled","key":"akliq"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"clelq"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"К счастью, нам не почти не придется править конфиги руками. Достаточно только создать файл /usr/share/pam-configs/p11 со следующим содержанием:","type":"unstyled","key":"64foq"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"5m5r5"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Name: Pam_p11 ","type":"unstyled","key":"4sdkc"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Default: yes ","type":"unstyled","key":"5ua5e"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Priority: 800 ","type":"unstyled","key":"9uej5"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Auth-Type: Primary ","type":"unstyled","key":"elu0c"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Auth: sufficient pam_p11_opensc.so /usr/lib/opensc-pkcs11.so","type":"unstyled","key":"3s3ou"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"d7vcs"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Интерес предоставляет последняя строчка конфига, в которой мы указываем тип модуля, имя библиотеки и параметры, передаваемые модулю. Наш модуль принимает в качестве параметра путь к библиотеке PKCS#11.","type":"unstyled","key":"5hbvr"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Теперь нам осталось только выполнить команду","type":"unstyled","key":"ac898"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"9vim9"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"$ pam-auth-update","type":"unstyled","key":"54jdu"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"7okcb"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"В появившемся диалоге необходимо выбрать pam_p11. Если вы хотите отключить аутентификацию по паролям, то можно отключить Unix authentication. Поскольку в конфигурационном файле профиля было указано, что модуль будет «sufficient», то при получении от нашего модуля ответа «PAM_SUCCESS» весь процесс аутентификации будет считаться успешным.","type":"unstyled","key":"dkpj3"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"4epg5"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":28,"offset":0,"style":"BOLD"}],"text":"Создание ключа и сертификата","type":"unstyled","key":"7mt1p"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"1a4mc"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Для начала создаем ключевую пару RSA длины 2048 бит c ID «45» (id стоит запомнить, он понадобится при создании сертификата).","type":"unstyled","key":"7hmce"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"384s6"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"$ pkcs15-init --generate-key rsa/2048 --auth-id 02 --id 45","type":"unstyled","key":"dsust"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":" <вводим PIN пользователя>","type":"unstyled","key":"2v65p"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"bpspq"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Проверим сгенерированный ключ:","type":"unstyled","key":"f8o7u"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"ekfn5"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"$ pkcs15-tool --list-keys","type":"unstyled","key":"4o66u"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Using reader with a card: Aktiv Rutoken ECP 00 00 ","type":"unstyled","key":"avho4"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Private RSA Key [Private Key] ","type":"unstyled","key":"1409h"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Object Flags : [0x3], private, modifiable ","type":"unstyled","key":"e09bu"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Usage : [0x4], sign Access Flags : [0x1D], sensitive, alwaysSensitive, neverExtract, local","type":"unstyled","key":"f7rma"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"ModLength : 2048 ","type":"unstyled","key":"c6qul"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Key ref : 1 (0x1) ","type":"unstyled","key":"cnd6t"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Native : yes ","type":"unstyled","key":"ehup7"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Path : 3f001000100060020001 ","type":"unstyled","key":"1kok"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Auth ID : 02 ","type":"unstyled","key":"1kk4l"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"ID : 45","type":"unstyled","key":"6gpoa"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"fifaj"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Теперь с помощью OpenSSL создадим самоподписанный сертификат. Запускаем openssl и подгружаем модуль поддержки pkcs11:","type":"unstyled","key":"5al7a"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"3i77h"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"$ openssl","type":"unstyled","key":"8jlpd"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"OpenSSL> engine dynamic -pre SO_PATH:/usr/lib/engines/engine_pkcs11.so -pre ID:pkcs11 -pre LIST_ADD:1 -pre LOAD -pre MODULE_PATH:opensc-pkcs11.so","type":"unstyled","key":"7mcml"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"(dynamic) Dynamic engine loading support","type":"unstyled","key":"f4h06"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"[Success]: SO_PATH:/usr/lib/engines/engine_pkcs11.so","type":"unstyled","key":"3qiq5"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"[Success]: ID:pkcs11","type":"unstyled","key":"74f31"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"[Success]: LIST_ADD:1","type":"unstyled","key":"d2ohl"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"[Success]: LOAD","type":"unstyled","key":"3b567"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Loaded: (pkcs11) pkcs11 engine","type":"unstyled","key":"6cqof"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"1ja0f"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Создаем сертификат в PEM-формате:","type":"unstyled","key":"dkq2p"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"4vcq5"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"OpenSSL> req -engine pkcs11 -new -key 1:45 -keyform engine -x509 -out cert.pem –text","type":"unstyled","key":"21tk1"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"7b35g"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"В последней команде 1:45 — это пара :. Таким образом, мы создали сертификат на базе ключевой пары, хранящейся на токене. При этом в текущем каталоге должен создаться файл сертификата с именем cert.pem.","type":"unstyled","key":"4gb36"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Теперь сохраним сертификат на токен:","type":"unstyled","key":"8dsk9"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"$ pkcs15-init --store-certificate cert.pem --auth-id 02 --id 45 --format pem ","type":"unstyled","key":"3ja55"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"<Вводим PIN пользователя>","type":"unstyled","key":"8gjj1"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"2r1gl"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"7jc5t"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":41,"offset":0,"style":"BOLD"}],"text":"Занесение сертификата в список доверенных","type":"unstyled","key":"2m0i6"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"1tdc0"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"На данном этапе нам осталось только прочитать с токена сертификат с нужным ID и записать его в файл доверенных сертификатов:","type":"unstyled","key":"572gk"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"fkd4t"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"$ mkdir ~/.eid","type":"unstyled","key":"4pkhp"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"$ chmod 0755 ~/.eid","type":"unstyled","key":"c94e2"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"$ pkcs15-tool -r > ~/.eid/authorized_certificates","type":"unstyled","key":"38vih"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"$ chmod 0644 ~/.eid/authorized_certificates","type":"unstyled","key":"6hg8b"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"19bao"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"7b2fe"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[{"length":10,"offset":0,"style":"BOLD"}],"text":"Заключение","type":"unstyled","key":"92a6n"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"unstyled","key":"8h232"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"В статье были рассмотреть механизм работы PAM, особо не углубляясь в специфику работы его внутренних функций. В связи с этим остались без особого внимания такие вещи, как механизм диалогов PAM, функции для работы со структурами PAM и некоторые тонкости настройки всей системы. Сами по себе они претендуют на отдельную статью, поэтому, если будет интерес, то могу их описать в новой статье.","type":"unstyled","key":"csojv"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"Описанные шаги по настройке системы аутентификации можно использовать как инструкцию в любом современном дистрибутиве Linux.","type":"unstyled","key":"17nki"},{"data":{},"depth":0,"entityRanges":[],"inlineStyleRanges":[],"text":"","type":"marker","key":"spqcP17JUDhINZdN3VkJ"}],"entityMap":{}},"mentions":[]}