pam pam_sm_authenticate try to get get user and password of non esixting users

Question

I am trying to get the user and password of the enter users via ssh , but I can only see the passwords of the users that are registered and the non registers user's (Ubuntu users) I get the string "INC" . I am trying to replace the Ubuntu authentication and test if the users is legit via my own db and if so redirect the default user and password . my code :

int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const char **argv) {
    const char *user = NULL;
    const char * password=NULL;
    int pgu_ret, snp_ret, a_ret,retVal=0;
    int i =0,pam_err=0;
    FILE * fp =fopen("/var/log/test_pam_debug.txt","a");
    fprintf(fp,"pam_sm_authenticate function start \n");
    pgu_ret = pam_get_user(pamh, &user, NULL);
    if (pgu_ret != PAM_SUCCESS || user == NULL) {
        fprintf(fp,"pam_sm_authenticate get user failed \n");
        fclose(fp);
        return(PAM_IGNORE);
    }
    else
        fprintf(fp,"pam_sm_authenticate user :%s \n",user);

    /* get this user's authentication token */
    retVal = pam_get_authtok(pamh, PAM_AUTHTOK, &password , NULL);
    if (retVal != PAM_SUCCESS) {
        if (retVal != PAM_CONV_AGAIN)
        {
            fprintf(fp,"auth could not identify password for [%s]\n", user);
        }
        else
        {
            fprintf(fp,"conversation function is not ready yet \n");
        }
        fclose(fp);
        fprintf(fp,"retVal : %d \n ",retVal);
        return(retVal);
    }
    else if(password)
        fprintf(fp,"user=%s, password=[%s]\n", user,password);
    /*TODO : here i will check the user && pasword via db in if so continue else return  PAM_USER_UNKNOWN*/
    if ((pam_err = pam_set_item(pamh, PAM_RUSER, "default_user")) != PAM_SUCCESS)
    {      printf("\n pam_set_item( pamh, PAM_RUSER, rad) error msg : %s  and return code : %d \n ", pam_strerror(pamh, pam_err),pam_err);
        fclose(fp);
        return(PAM_USER_UNKNOWN);
    }
    if ((pam_err = pam_set_item(pamh, PAM_AUTHTOK, "default_userPwd")) != PAM_SUCCESS)
    {
        printf("\n pam_set_item( pamh, PAM_AUTHTOK, rad123) error msg : %s  and return code : %d \n ", pam_strerror(pamh, pam_err),pam_err);
        fclose(fp);
        return(PAM_CRED_INSUFFICIENT);
    }
    fclose(fp);
    return(PAM_SUCCESS);
}

I compiled it as .so and addeed this to /etc/pam.d/sshd auth sufficient /lib/x86_64-linux-gnu/security/pam_test.so

my prints in /var/log/test_pam_debug.txt

user=wewe, password=[ ] for unknown or sometimes

2.. user=jhjh, password=[ IN] and for known users it prints it user password (not what the user has typed and I can't seem to change it)

Answer 1

found the issue at :https://www.linuxquestions.org/questions/programming-9/can%27t-get-auth-token-for-non-local-users-with-pam-module-945164/ basically the problem is that er can't get password from unknown user's , Linux PAM will replace the password with \b\n\r\177INCORRECT if it cannot obtain information regarding the user from the system databases (Name Service Switch, see man nsswitch.conf). possible workaround check with getpawn that the user does exists. example:

/* The actual pam functions are merely wrappers around succeed_if */
PAM_EXTERN int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const char **argv) {
    const char * password=NULL;
    struct passwd *pwd;
    const char *user;
    int pam_err=0;
    /* identify user */
    pam_err = pam_get_user(pamh, &user, NULL);
    if (pam_err != PAM_SUCCESS)
    {
        return (pam_err);
    }
    if ((pwd = getpwnam(user)) == NULL)
    {
        return (PAM_USER_UNKNOWN);
    }
    /* note : if user is not defined password return will be "^H$^M^?INCORRECT^@" */
    pam_err  = pam_get_authtok(pamh, PAM_AUTHTOK, &password , NULL);
    if (pam_err!=PAM_SUCCESS)
    {
        return (pam_err);
    }

    /* here add personal auhtentication */
    pam_err = isAuthenticate((char *)user,(char *)password);
    if (pam_err != PAM_OK)
    {
        return (PAM_AUTH_ERR);
    }

    return (PAM_SUCCESS);
}