1 /* $OpenBSD: auth.c,v 1.94 2011/05/23 03:33:38 djm Exp $ */
2 /*
3 * Copyright (c) 2000 Markus Friedl. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 */
25
26 #include "includes.h"
27
28 #include <sys/types.h>
29 #include <sys/stat.h>
30 #include <sys/param.h>
31
32 #include <netinet/in.h>
33
34 #include <errno.h>
35 #include <fcntl.h>
36 #ifdef HAVE_PATHS_H
37 # include <paths.h>
38 #endif
39 #include <pwd.h>
40 #ifdef HAVE_LOGIN_H
41 #include <login.h>
42 #endif
43 #ifdef USE_SHADOW
44 #include <shadow.h>
45 #endif
46 #ifdef HAVE_LIBGEN_H
47 #include <libgen.h>
48 #endif
49 #include <stdarg.h>
50 #include <stdio.h>
51 #include <string.h>
52 #include <unistd.h>
53
54 #include "xmalloc.h"
55 #include "match.h"
56 #include "groupaccess.h"
57 #include "log.h"
58 #include "buffer.h"
59 #include "servconf.h"
60 #include "key.h"
61 #include "hostfile.h"
62 #include "auth.h"
63 #include "auth-options.h"
64 #include "canohost.h"
65 #include "uidswap.h"
66 #include "misc.h"
67 #include "packet.h"
68 #include "loginrec.h"
69 #ifdef GSSAPI
70 #include "ssh-gss.h"
71 #endif
72 #include "authfile.h"
73 #include "monitor_wrap.h"
74
75 /* import */
76 extern ServerOptions options;
77 extern int use_privsep;
78 extern Buffer loginmsg;
79 extern struct passwd *privsep_pw;
80
81 /* Debugging messages */
82 Buffer auth_debug;
83 int auth_debug_init;
84
85 /*
86 * Check if the user is allowed to log in via ssh. If user is listed
87 * in DenyUsers or one of user's groups is listed in DenyGroups, false
88 * will be returned. If AllowUsers isn't empty and user isn't listed
89 * there, or if AllowGroups isn't empty and one of user's groups isn't
90 * listed there, false will be returned.
91 * If the user's shell is not executable, false will be returned.
92 * Otherwise true is returned.
93 */
94 int
allowed_user(struct passwd * pw)95 allowed_user(struct passwd * pw)
96 {
97 struct stat st;
98 const char *hostname = NULL, *ipaddr = NULL, *passwd = NULL;
99 u_int i;
100 #ifdef USE_SHADOW
101 struct spwd *spw = NULL;
102 #endif
103
104 /* Shouldn't be called if pw is NULL, but better safe than sorry... */
105 if (!pw || !pw->pw_name)
106 return 0;
107
108 #ifdef USE_SHADOW
109 if (!options.use_pam)
110 spw = getspnam(pw->pw_name);
111 #ifdef HAS_SHADOW_EXPIRE
112 if (!options.use_pam && spw != NULL && auth_shadow_acctexpired(spw))
113 return 0;
114 #endif /* HAS_SHADOW_EXPIRE */
115 #endif /* USE_SHADOW */
116
117 /* grab passwd field for locked account check */
118 passwd = pw->pw_passwd;
119 #ifdef USE_SHADOW
120 if (spw != NULL)
121 #ifdef USE_LIBIAF
122 passwd = get_iaf_password(pw);
123 #else
124 passwd = spw->sp_pwdp;
125 #endif /* USE_LIBIAF */
126 #endif
127
128 /* check for locked account */
129 if (!options.use_pam && passwd && *passwd) {
130 int locked = 0;
131
132 #ifdef LOCKED_PASSWD_STRING
133 if (strcmp(passwd, LOCKED_PASSWD_STRING) == 0)
134 locked = 1;
135 #endif
136 #ifdef LOCKED_PASSWD_PREFIX
137 if (strncmp(passwd, LOCKED_PASSWD_PREFIX,
138 strlen(LOCKED_PASSWD_PREFIX)) == 0)
139 locked = 1;
140 #endif
141 #ifdef LOCKED_PASSWD_SUBSTR
142 if (strstr(passwd, LOCKED_PASSWD_SUBSTR))
143 locked = 1;
144 #endif
145 #ifdef USE_LIBIAF
146 free((void *) passwd);
147 #endif /* USE_LIBIAF */
148 if (locked) {
149 logit("User %.100s not allowed because account is locked",
150 pw->pw_name);
151 return 0;
152 }
153 }
154
155 /*
156 * Deny if shell does not exist or is not executable unless we
157 * are chrooting.
158 */
159 if (options.chroot_directory == NULL ||
160 strcasecmp(options.chroot_directory, "none") == 0) {
161 char *shell = xstrdup((pw->pw_shell[0] == '\0') ?
162 _PATH_BSHELL : pw->pw_shell); /* empty = /bin/sh */
163
164 if (stat(shell, &st) != 0) {
165 logit("User %.100s not allowed because shell %.100s "
166 "does not exist", pw->pw_name, shell);
167 xfree(shell);
168 return 0;
169 }
170 if (S_ISREG(st.st_mode) == 0 ||
171 (st.st_mode & (S_IXOTH|S_IXUSR|S_IXGRP)) == 0) {
172 logit("User %.100s not allowed because shell %.100s "
173 "is not executable", pw->pw_name, shell);
174 xfree(shell);
175 return 0;
176 }
177 xfree(shell);
178 }
179
180 if (options.num_deny_users > 0 || options.num_allow_users > 0 ||
181 options.num_deny_groups > 0 || options.num_allow_groups > 0) {
182 hostname = get_canonical_hostname(options.use_dns);
183 ipaddr = get_remote_ipaddr();
184 }
185
186 /* Return false if user is listed in DenyUsers */
187 if (options.num_deny_users > 0) {
188 for (i = 0; i < options.num_deny_users; i++)
189 if (match_user(pw->pw_name, hostname, ipaddr,
190 options.deny_users[i])) {
191 logit("User %.100s from %.100s not allowed "
192 "because listed in DenyUsers",
193 pw->pw_name, hostname);
194 return 0;
195 }
196 }
197 /* Return false if AllowUsers isn't empty and user isn't listed there */
198 if (options.num_allow_users > 0) {
199 for (i = 0; i < options.num_allow_users; i++)
200 if (match_user(pw->pw_name, hostname, ipaddr,
201 options.allow_users[i]))
202 break;
203 /* i < options.num_allow_users iff we break for loop */
204 if (i >= options.num_allow_users) {
205 logit("User %.100s from %.100s not allowed because "
206 "not listed in AllowUsers", pw->pw_name, hostname);
207 return 0;
208 }
209 }
210 if (options.num_deny_groups > 0 || options.num_allow_groups > 0) {
211 /* Get the user's group access list (primary and supplementary) */
212 if (ga_init(pw->pw_name, pw->pw_gid) == 0) {
213 logit("User %.100s from %.100s not allowed because "
214 "not in any group", pw->pw_name, hostname);
215 return 0;
216 }
217
218 /* Return false if one of user's groups is listed in DenyGroups */
219 if (options.num_deny_groups > 0)
220 if (ga_match(options.deny_groups,
221 options.num_deny_groups)) {
222 ga_free();
223 logit("User %.100s from %.100s not allowed "
224 "because a group is listed in DenyGroups",
225 pw->pw_name, hostname);
226 return 0;
227 }
228 /*
229 * Return false if AllowGroups isn't empty and one of user's groups
230 * isn't listed there
231 */
232 if (options.num_allow_groups > 0)
233 if (!ga_match(options.allow_groups,
234 options.num_allow_groups)) {
235 ga_free();
236 logit("User %.100s from %.100s not allowed "
237 "because none of user's groups are listed "
238 "in AllowGroups", pw->pw_name, hostname);
239 return 0;
240 }
241 ga_free();
242 }
243
244 #ifdef CUSTOM_SYS_AUTH_ALLOWED_USER
245 if (!sys_auth_allowed_user(pw, &loginmsg))
246 return 0;
247 #endif
248
249 /* We found no reason not to let this user try to log on... */
250 return 1;
251 }
252
253 void
auth_log(Authctxt * authctxt,int authenticated,char * method,char * info)254 auth_log(Authctxt *authctxt, int authenticated, char *method, char *info)
255 {
256 void (*authlog) (const char *fmt,...) = verbose;
257 char *authmsg;
258
259 if (use_privsep && !mm_is_monitor() && !authctxt->postponed)
260 return;
261
262 /* Raise logging level */
263 if (authenticated == 1 ||
264 !authctxt->valid ||
265 authctxt->failures >= options.max_authtries / 2 ||
266 strcmp(method, "password") == 0)
267 authlog = logit;
268
269 if (authctxt->postponed)
270 authmsg = "Postponed";
271 else
272 authmsg = authenticated ? "Accepted" : "Failed";
273
274 authlog("%s %s for %s%.100s from %.200s port %d%s",
275 authmsg,
276 method,
277 authctxt->valid ? "" : "invalid user ",
278 authctxt->user,
279 get_remote_ipaddr(),
280 get_remote_port(),
281 info);
282
283 #ifdef CUSTOM_FAILED_LOGIN
284 if (authenticated == 0 && !authctxt->postponed &&
285 (strcmp(method, "password") == 0 ||
286 strncmp(method, "keyboard-interactive", 20) == 0 ||
287 strcmp(method, "challenge-response") == 0))
288 record_failed_login(authctxt->user,
289 get_canonical_hostname(options.use_dns), "ssh");
290 # ifdef WITH_AIXAUTHENTICATE
291 if (authenticated)
292 sys_auth_record_login(authctxt->user,
293 get_canonical_hostname(options.use_dns), "ssh", &loginmsg);
294 # endif
295 #endif
296 #ifdef SSH_AUDIT_EVENTS
297 if (authenticated == 0 && !authctxt->postponed)
298 audit_event(audit_classify_auth(method));
299 #endif
300 }
301
302 /*
303 * Check whether root logins are disallowed.
304 */
305 int
auth_root_allowed(char * method)306 auth_root_allowed(char *method)
307 {
308 switch (options.permit_root_login) {
309 case PERMIT_YES:
310 return 1;
311 case PERMIT_NO_PASSWD:
312 if (strcmp(method, "password") != 0)
313 return 1;
314 break;
315 case PERMIT_FORCED_ONLY:
316 if (forced_command) {
317 logit("Root login accepted for forced command.");
318 return 1;
319 }
320 break;
321 }
322 logit("ROOT LOGIN REFUSED FROM %.200s", get_remote_ipaddr());
323 return 0;
324 }
325
326
327 /*
328 * Given a template and a passwd structure, build a filename
329 * by substituting % tokenised options. Currently, %% becomes '%',
330 * %h becomes the home directory and %u the username.
331 *
332 * This returns a buffer allocated by xmalloc.
333 */
334 char *
expand_authorized_keys(const char * filename,struct passwd * pw)335 expand_authorized_keys(const char *filename, struct passwd *pw)
336 {
337 char *file, ret[MAXPATHLEN];
338 int i;
339
340 file = percent_expand(filename, "h", pw->pw_dir,
341 "u", pw->pw_name, (char *)NULL);
342
343 /*
344 * Ensure that filename starts anchored. If not, be backward
345 * compatible and prepend the '%h/'
346 */
347 if (*file == '/')
348 return (file);
349
350 i = snprintf(ret, sizeof(ret), "%s/%s", pw->pw_dir, file);
351 if (i < 0 || (size_t)i >= sizeof(ret))
352 fatal("expand_authorized_keys: path too long");
353 xfree(file);
354 return (xstrdup(ret));
355 }
356
357 char *
authorized_principals_file(struct passwd * pw)358 authorized_principals_file(struct passwd *pw)
359 {
360 if (options.authorized_principals_file == NULL)
361 return NULL;
362 return expand_authorized_keys(options.authorized_principals_file, pw);
363 }
364
365 /* return ok if key exists in sysfile or userfile */
366 HostStatus
check_key_in_hostfiles(struct passwd * pw,Key * key,const char * host,const char * sysfile,const char * userfile)367 check_key_in_hostfiles(struct passwd *pw, Key *key, const char *host,
368 const char *sysfile, const char *userfile)
369 {
370 char *user_hostfile;
371 struct stat st;
372 HostStatus host_status;
373 struct hostkeys *hostkeys;
374 const struct hostkey_entry *found;
375
376 hostkeys = init_hostkeys();
377 load_hostkeys(hostkeys, host, sysfile);
378 if (userfile != NULL) {
379 user_hostfile = tilde_expand_filename(userfile, pw->pw_uid);
380 if (options.strict_modes &&
381 (stat(user_hostfile, &st) == 0) &&
382 ((st.st_uid != 0 && st.st_uid != pw->pw_uid) ||
383 (st.st_mode & 022) != 0)) {
384 logit("Authentication refused for %.100s: "
385 "bad owner or modes for %.200s",
386 pw->pw_name, user_hostfile);
387 auth_debug_add("Ignored %.200s: bad ownership or modes",
388 user_hostfile);
389 } else {
390 temporarily_use_uid(pw);
391 load_hostkeys(hostkeys, host, user_hostfile);
392 restore_uid();
393 }
394 xfree(user_hostfile);
395 }
396 host_status = check_key_in_hostkeys(hostkeys, key, &found);
397 if (host_status == HOST_REVOKED)
398 error("WARNING: revoked key for %s attempted authentication",
399 found->host);
400 else if (host_status == HOST_OK)
401 debug("%s: key for %s found at %s:%ld", __func__,
402 found->host, found->file, found->line);
403 else
404 debug("%s: key for host %s not found", __func__, host);
405
406 free_hostkeys(hostkeys);
407
408 return host_status;
409 }
410
411
412 /*
413 * Check a given file for security. This is defined as all components
414 * of the path to the file must be owned by either the owner of
415 * of the file or root and no directories must be group or world writable.
416 *
417 * XXX Should any specific check be done for sym links ?
418 *
419 * Takes an open file descriptor, the file name, a uid and and
420 * error buffer plus max size as arguments.
421 *
422 * Returns 0 on success and -1 on failure
423 */
424 static int
secure_filename(FILE * f,const char * file,struct passwd * pw,char * err,size_t errlen)425 secure_filename(FILE *f, const char *file, struct passwd *pw,
426 char *err, size_t errlen)
427 {
428 uid_t uid = pw->pw_uid;
429 char buf[MAXPATHLEN], homedir[MAXPATHLEN];
430 char *cp;
431 int comparehome = 0;
432 struct stat st;
433
434 if (realpath(file, buf) == NULL) {
435 snprintf(err, errlen, "realpath %s failed: %s", file,
436 strerror(errno));
437 return -1;
438 }
439 if (realpath(pw->pw_dir, homedir) != NULL)
440 comparehome = 1;
441
442 /* check the open file to avoid races */
443 if (fstat(fileno(f), &st) < 0 ||
444 (st.st_uid != 0 && st.st_uid != uid) ||
445 (st.st_mode & 022) != 0) {
446 #ifdef ANDROID
447 /* needed to allow root login on android */
448 if (getuid() != 0)
449 #endif
450 {
451 snprintf(err, errlen, "bad ownership or modes for file %s",
452 buf);
453 return -1;
454 }
455 }
456
457 /* for each component of the canonical path, walking upwards */
458 for (;;) {
459 if ((cp = dirname(buf)) == NULL) {
460 snprintf(err, errlen, "dirname() failed");
461 return -1;
462 }
463 strlcpy(buf, cp, sizeof(buf));
464
465 #ifndef ANDROID
466 /* /data is owned by system user, which causes this check to fail */
467 if (stat(buf, &st) < 0 ||
468 (st.st_uid != 0 && st.st_uid != uid) ||
469 (st.st_mode & 022) != 0) {
470 snprintf(err, errlen,
471 "bad ownership or modes for directory %s", buf);
472 return -1;
473 }
474 #endif
475 /* If are past the homedir then we can stop */
476 if (comparehome && strcmp(homedir, buf) == 0)
477 break;
478
479 /*
480 * dirname should always complete with a "/" path,
481 * but we can be paranoid and check for "." too
482 */
483 if ((strcmp("/", buf) == 0) || (strcmp(".", buf) == 0))
484 break;
485 }
486 return 0;
487 }
488
489 static FILE *
auth_openfile(const char * file,struct passwd * pw,int strict_modes,int log_missing,char * file_type)490 auth_openfile(const char *file, struct passwd *pw, int strict_modes,
491 int log_missing, char *file_type)
492 {
493 char line[1024];
494 struct stat st;
495 int fd;
496 FILE *f;
497
498 if ((fd = open(file, O_RDONLY|O_NONBLOCK)) == -1) {
499 if (log_missing || errno != ENOENT)
500 debug("Could not open %s '%s': %s", file_type, file,
501 strerror(errno));
502 return NULL;
503 }
504
505 if (fstat(fd, &st) < 0) {
506 close(fd);
507 return NULL;
508 }
509 if (!S_ISREG(st.st_mode)) {
510 logit("User %s %s %s is not a regular file",
511 pw->pw_name, file_type, file);
512 close(fd);
513 return NULL;
514 }
515 unset_nonblock(fd);
516 if ((f = fdopen(fd, "r")) == NULL) {
517 close(fd);
518 return NULL;
519 }
520 if (strict_modes &&
521 secure_filename(f, file, pw, line, sizeof(line)) != 0) {
522 fclose(f);
523 logit("Authentication refused: %s", line);
524 auth_debug_add("Ignored %s: %s", file_type, line);
525 return NULL;
526 }
527
528 return f;
529 }
530
531
532 FILE *
auth_openkeyfile(const char * file,struct passwd * pw,int strict_modes)533 auth_openkeyfile(const char *file, struct passwd *pw, int strict_modes)
534 {
535 return auth_openfile(file, pw, strict_modes, 1, "authorized keys");
536 }
537
538 FILE *
auth_openprincipals(const char * file,struct passwd * pw,int strict_modes)539 auth_openprincipals(const char *file, struct passwd *pw, int strict_modes)
540 {
541 return auth_openfile(file, pw, strict_modes, 0,
542 "authorized principals");
543 }
544
545 struct passwd *
getpwnamallow(const char * user)546 getpwnamallow(const char *user)
547 {
548 #ifdef HAVE_LOGIN_CAP
549 extern login_cap_t *lc;
550 #ifdef BSD_AUTH
551 auth_session_t *as;
552 #endif
553 #endif
554 struct passwd *pw;
555
556 parse_server_match_config(&options, user,
557 get_canonical_hostname(options.use_dns), get_remote_ipaddr());
558
559 #if defined(_AIX) && defined(HAVE_SETAUTHDB)
560 aix_setauthdb(user);
561 #endif
562
563 pw = getpwnam(user);
564
565 #if defined(_AIX) && defined(HAVE_SETAUTHDB)
566 aix_restoreauthdb();
567 #endif
568 #ifdef HAVE_CYGWIN
569 /*
570 * Windows usernames are case-insensitive. To avoid later problems
571 * when trying to match the username, the user is only allowed to
572 * login if the username is given in the same case as stored in the
573 * user database.
574 */
575 if (pw != NULL && strcmp(user, pw->pw_name) != 0) {
576 logit("Login name %.100s does not match stored username %.100s",
577 user, pw->pw_name);
578 pw = NULL;
579 }
580 #endif
581 if (pw == NULL) {
582 logit("Invalid user %.100s from %.100s",
583 user, get_remote_ipaddr());
584 #ifdef CUSTOM_FAILED_LOGIN
585 record_failed_login(user,
586 get_canonical_hostname(options.use_dns), "ssh");
587 #endif
588 #ifdef SSH_AUDIT_EVENTS
589 audit_event(SSH_INVALID_USER);
590 #endif /* SSH_AUDIT_EVENTS */
591 return (NULL);
592 }
593 if (!allowed_user(pw))
594 return (NULL);
595 #ifdef HAVE_LOGIN_CAP
596 if ((lc = login_getclass(pw->pw_class)) == NULL) {
597 debug("unable to get login class: %s", user);
598 return (NULL);
599 }
600 #ifdef BSD_AUTH
601 if ((as = auth_open()) == NULL || auth_setpwd(as, pw) != 0 ||
602 auth_approval(as, lc, pw->pw_name, "ssh") <= 0) {
603 debug("Approval failure for %s", user);
604 pw = NULL;
605 }
606 if (as != NULL)
607 auth_close(as);
608 #endif
609 #endif
610 if (pw != NULL)
611 return (pwcopy(pw));
612 return (NULL);
613 }
614
615 /* Returns 1 if key is revoked by revoked_keys_file, 0 otherwise */
616 int
auth_key_is_revoked(Key * key)617 auth_key_is_revoked(Key *key)
618 {
619 char *key_fp;
620
621 if (options.revoked_keys_file == NULL)
622 return 0;
623
624 switch (key_in_file(key, options.revoked_keys_file, 0)) {
625 case 0:
626 /* key not revoked */
627 return 0;
628 case -1:
629 /* Error opening revoked_keys_file: refuse all keys */
630 error("Revoked keys file is unreadable: refusing public key "
631 "authentication");
632 return 1;
633 case 1:
634 /* Key revoked */
635 key_fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
636 error("WARNING: authentication attempt with a revoked "
637 "%s key %s ", key_type(key), key_fp);
638 xfree(key_fp);
639 return 1;
640 }
641 fatal("key_in_file returned junk");
642 }
643
644 void
auth_debug_add(const char * fmt,...)645 auth_debug_add(const char *fmt,...)
646 {
647 char buf[1024];
648 va_list args;
649
650 if (!auth_debug_init)
651 return;
652
653 va_start(args, fmt);
654 vsnprintf(buf, sizeof(buf), fmt, args);
655 va_end(args);
656 buffer_put_cstring(&auth_debug, buf);
657 }
658
659 void
auth_debug_send(void)660 auth_debug_send(void)
661 {
662 char *msg;
663
664 if (!auth_debug_init)
665 return;
666 while (buffer_len(&auth_debug)) {
667 msg = buffer_get_string(&auth_debug, NULL);
668 packet_send_debug("%s", msg);
669 xfree(msg);
670 }
671 }
672
673 void
auth_debug_reset(void)674 auth_debug_reset(void)
675 {
676 if (auth_debug_init)
677 buffer_clear(&auth_debug);
678 else {
679 buffer_init(&auth_debug);
680 auth_debug_init = 1;
681 }
682 }
683
684 struct passwd *
fakepw(void)685 fakepw(void)
686 {
687 static struct passwd fake;
688
689 memset(&fake, 0, sizeof(fake));
690 fake.pw_name = "NOUSER";
691 fake.pw_passwd =
692 "$2a$06$r3.juUaHZDlIbQaO2dS9FuYxL1W9M81R1Tc92PoSNmzvpEqLkLGrK";
693 #ifdef HAVE_PW_GECOS_IN_PASSWD
694 fake.pw_gecos = "NOUSER";
695 #endif
696 fake.pw_uid = privsep_pw == NULL ? (uid_t)-1 : privsep_pw->pw_uid;
697 fake.pw_gid = privsep_pw == NULL ? (gid_t)-1 : privsep_pw->pw_gid;
698 #ifdef HAVE_PW_CLASS_IN_PASSWD
699 fake.pw_class = "";
700 #endif
701 fake.pw_dir = "/nonexist";
702 fake.pw_shell = "/nonexist";
703
704 return (&fake);
705 }
706