- if (!(pw = getpwnam(myname)))
- err(1, "getpwnam");
-
- hash = pw->pw_passwd;
- if (hash[0] == 'x' && hash[1] == '\0') {
- struct spwd *sp;
- if (!(sp = getspnam(myname)))
- errx(1, "Authorization failed");
- hash = sp->sp_pwdp;
- } else if (hash[0] != '*') {
- errx(1, "Authorization failed");
- }
-
- char *challenge, *response, rbuf[1024], cbuf[128], host[HOST_NAME_MAX + 1];
- if (gethostname(host, sizeof(host)))
- snprintf(host, sizeof(host), "?");
- snprintf(cbuf, sizeof(cbuf),
- "\rdoas (%.32s@%.32s) password: ", myname, host);
- challenge = cbuf;
-
- response = readpassphrase(challenge, rbuf, sizeof(rbuf), RPP_REQUIRE_TTY);
- if (response == NULL && errno == ENOTTY) {
- syslog(LOG_AUTHPRIV | LOG_NOTICE,
- "tty required for %s", myname);
- errx(1, "a tty is required");
- }
- if (!(encrypted = crypt(response, hash)))
- errx(1, "crypt");
- if (strcmp(encrypted, hash) != 0) {
- syslog(LOG_AUTHPRIV | LOG_NOTICE, "failed auth for %s", myname);
- errx(1, "Authorization failed");
- }
- explicit_bzero(rbuf, sizeof(rbuf));
-#ifdef PERSIST_TIMESTAMP
-good:
- if (fd != -1) {
- persist_set(fd, 5 * 60);
- close(fd);
- }
-#endif