#! /usr/bin/perl
$ID = q($Id: klogin 311 2005-08-24 04:43:30Z rra $ );
$VERSION = '2.18';
#
# klogin -- Interface to kerberized rlogin and telnet.
#
#       Written by Russ Allbery <rra@stanford.edu>
# Based on code by Roland Schemers <schemers@stanford.edu>
#
# Copyright 1994, 1996, 1997, 1999, 2001, 2002, 2003
#     Board of Trustees, Leland Stanford Jr. University

##############################################################################
# Site configuration
##############################################################################

# Find locations of Kerberos programs.  These directories are searched before
# the user path.  /usr/pubsw/bin is the standard Stanford location, and
# /etc/leland/bin is used for our Kerberos kits.
@PATH = qw(/usr/pubsw/bin /usr/local/bin /etc/leland/bin);

##############################################################################
# Modules and declarations
##############################################################################

require 5.004;

use Getopt::Long qw(GetOptions);

use strict;
use vars qw(%CONFIG $ID %PATH @PATH $VERSION);

##############################################################################
# Option parsing
##############################################################################

# Print out a brief help message and exit.  (Used for -h or --help on the
# command line.)
sub usage {
    warn <<"EOM";
Usage: $0 [-hvfTVxX] [-l username] [telnet/rlogin options] host [port]

klogin optionally forwards your Kerberos tgt and .Xauthority file to the
machine host and then performs a Kerberized rlogin to that machine.  If the
-T flag is used or this program is invoked as ktelnet instead, Kerberized
telnet is used instead of rlogin.  Note that the optional port argument is
ignored if using rlogin.

    -h              Print this message and exit.
    -v              Print the version number and exit.
    -A              Forward your .Xauthority file to the remote host.
    -f              Don't forward your ticket.
    -l username     Log in as username.
    -T              Connect with telnet instead of rlogin.
    -V              Display each command executed before running them.
    -x              Don't encrypt telnet/rlogin session.

You can also give klogin any options supported by either telnet or rlogin,
and they will be passed to telnet or rlogin as appropriate.
EOM
    exit 0;
}

# Get the fully qualified name for a host.  We do this because the real name
# may vary from the name given on the command line if they're going to a
# load-balanced address and because we want to trim off the domain if it's the
# same as our domain.
sub qualify {
    my ($host) = @_;
    my ($type, $realhost) = (gethostbyname $host)[2,4];
    $realhost = gethostbyaddr ($realhost, $type);
    die "$0: unknown host $host\n" unless $realhost;
    eval { require Net::Domain };
    unless ($@) {
        my $domain = Net::Domain::hostdomain ();
        $realhost =~ s/\Q.$domain\E$//i;
    }
    $realhost;
}

# Find a programs that we care about.  We search @PATH and then the user's
# PATH.  It would be better to search the user's PATH first, but that makes it
# too likely that we'll find a non-Kerberos rlogin or telnet.  If we can't
# find the executable, we return the first path in @PATH (which will probably
# then fail later).
sub search_path {
    my $program = shift;
    for (@PATH, split (':', $ENV{PATH})) {
        return "$_/$program" if -x "$_/$program";
    }
    return "$PATH[0]/$program";
}

# Set up the %PATH hash with the locations of the programs we care about,
# honoring environment variables for each one.
sub find_programs {
    $PATH{kftgt}  = $ENV{'KLOGIN_KFTGT_PROGRAM'}  || search_path 'kftgt';
    $PATH{rcp}    = $ENV{'KLOGIN_RCP_PROGRAM'}    || search_path 'rcp';
    $PATH{rlogin} = $ENV{'KLOGIN_RLOGIN_PROGRAM'} || search_path 'rlogin';
    $PATH{telnet} = $ENV{'KLOGIN_TELNET_PROGRAM'} || search_path 'telnet';
}

# Parse command-line options, ensure that the arguments are consistent, and
# get the local domain so that we can abbreviate if we want to.  Note that we
# allow the backwards host first, then argument form for backward
# compatibility and compatibility with the Kerberos rlogin (which requires
# that form).  The options are stored in the global %CONFIG hash.
#
# Note that klogin *reverses* the default meaning of the -x, -f, and -F flags
# to rlogin and telnet and the -a flag is always passed to telnet regardless
# (-l should be used if the username is different on the remote system).
sub parse_options {
    my ($host, $port);

    # First off, pull off $ARGV[0] and see if it's a flag.  If it isn't, it's
    # a hostname and they're using the reverse syntax, so we need to stash it
    # somewhere.
    if (@ARGV && $ARGV[0] !~ /^-/) {
        $host = shift @ARGV;
        if (@ARGV && $ARGV[0] !~ /^-/) { $port = shift @ARGV }
    }

    # This is complicated, mainly because we're dealing with three separate
    # programs:  The original klogin script, which we want to be backwards
    # compatible with; Kerberos rlogin, which is largely a braindead BSD
    # rlogin; and Kerberos telnet, which is a SYSV telnet.  The following are
    # the options we support.  (k) indicates an option which was present in
    # the original klogin, (r) indicates an option to rlogin, and (t)
    # indicates an option to telnet.
    my @options = ('8-bit|8bit|8',        # use an 8-bit data path      (tr)
                   '7-bit|7bit|7',        # force a 7-bit data path      (r)
                   'confirm|skiprc|c',    # (t) skip rc (r) confirm     (tr)
                   'debug|d',             # enable debugging output     (tr)
                   'disable-auth|X=s',    # disable a type of auth       (t)
                   'escape|e=s',          # set escape character        (tr)
                   'flow!',               # soft flow control support    (r)
                   'help|h',              # general usage                (k)
                   'litout|L',            # 8-bit data path for output  (tr)
                   'login|user|l=s',      # specify remote username    (trk)
                   'noencrypt|x',         # don't encrypt session      (trk)
                   'noescape|E',          # no escape character          (t)
                   'noforward|f',         # don't forward ticket        (kt)
                   'noforwardable|F',     # don't forward forwardable   (tr)
                   'protocol|P=s',        # rlogin protocol (N or O)     (r)
                   'realm|k=s',           # Kerberos realm              (tr)
                   'telnet|T',            # force use of telnet
                   'term|t=s',            # remote terminal type         (r)
                   'trace|nosuspend|n:s', # (t) trace (r) no suspend    (tr)
                   'tos|S',               # sets type of service         (t)
                   'verbose|V',           # verbose output               (k)
                   'version|v',           # version                      (k)
                   'xauth|A');            # forward Xauthority file

    # Do the options parse.
    Getopt::Long::config ('bundling_override');
    GetOptions (\%CONFIG, @options);

    # If they requested usage or version, give them that and exit.
    if ($CONFIG{help}) { usage }
    if ($CONFIG{version}) {
        my @version = split (' ', $ID);
        shift @version if $ID =~ /^\$Id/;
        $version[1] = $VERSION;
        my $version = join (' ', @version[0..2]);
        $version =~ s/,v\b//;
        $version =~ s/(\S+)$/($1)/;
        $version =~ tr%/%-%;
        print $version, "\n";
        exit;
    }

    # I'd really prefer not to support this, but we're stuck with it.  Which
    # means I should go back and add in support for all of the flags we
    # support.  And some way to turn off on the command line something that's
    # turned on in the environment....
    local $_;
    if ($_ = $ENV{'KLOGIN_OPTS'}) {
        $CONFIG{noforward} ||= /f/;
        $CONFIG{telnet}    ||= /T/;
        $CONFIG{verbose}   ||= /V/;
        $CONFIG{noencrpyt} ||= /x/;
        $CONFIG{xauth}     ||= /X/;
    }

    # If we're invoked as ktelnet, that should be the same as -T.
    $CONFIG{telnet} ||= ($0 =~ /telnet/);

    # Now we do a little sanity checking.
    unless (defined $host) {
        $host = shift @ARGV;
        $port = shift @ARGV if $CONFIG{telnet};
        die "$0: no host specified (-h for help)\n" unless defined $host;
    }
    if ($CONFIG{noforward} and $CONFIG{xauth}) {
        die "$0: inconsistant options -f and -A (-h for help)\n";
    }

    # Do a forward and then reverse name lookup on the hostname.  This is
    # required because of our load-balancing system; otherwise, we may forward
    # our ticket to one host and then try to rlogin to another.
    $host = qualify ($host);

    # Build our option string for the underlying program (rlogin or telnet).
    # There may be a better way of doing it than this, but none occurs to me.
    # Go through all the options that are appropriate for rlogin or telnet and
    # mush them all together.
    my $options = "";
    @options = ();
    push (@options, '-8') if $CONFIG{'8-bit'};
    push (@options, '-c') if $CONFIG{confirm};
    push (@options, '-d') if $CONFIG{debug};
    push (@options, '-L') if $CONFIG{litout};
    push (@options, '-t') if $CONFIG{trace};
    push (@options, '-x') unless $CONFIG{noencrypt};
    push (@options, '-e', $CONFIG{escape}) if $CONFIG{escape};
    push (@options, '-l', $CONFIG{login})  if $CONFIG{login};
    push (@options, '-k', $CONFIG{realm})  if $CONFIG{realm};
    unless ($CONFIG{noforward}) {
        push (@options, $CONFIG{noforwardable} ? '-f' : '-F');
    }
    if ($CONFIG{telnet}) {
        push (@options, '-E') if $CONFIG{noescape};
        push (@options, '-a');
        push (@options, '-X', $CONFIG{'disable-auth'})
            if $CONFIG{'disable-auth'};
        push (@options, '-S', $CONFIG{tos})   if $CONFIG{tos};
        push (@options, '-n', $CONFIG{trace}) if $CONFIG{trace};
    } else {
        push (@options, '-7') if $CONFIG{'7-bit'};
        push (@options, '-n') if $CONFIG{trace};
        push (@options, '-t', $CONFIG{term})      if $CONFIG{term};
        push (@options, '-P' . $CONFIG{protocol}) if $CONFIG{protocol};
        if ($CONFIG{flow}) {
            push (@options, '-flow');
        } elsif (exists $CONFIG{flow}) {
            push (@options, '-noflow');
        }
    }

    # Move things into the hash for convenience.
    $CONFIG{host} = $host;
    $CONFIG{port} = $port if defined $port;
    $CONFIG{options} = [ @options ];
}

##############################################################################
# Xauthority and ticket forwarding
##############################################################################

# Forward the user's tgt to the remote host using kftgt.  We have to look for
# a -l command line option and be sure to pass that along to kftgt as well.
sub forward_ticket {
    my ($host) = @_;
    my @command = $PATH{kftgt};
    push (@command, '-l', $CONFIG{login}) if $CONFIG{login};
    push (@command, $host);
    print "@command\n" if $CONFIG{verbose};
    system (@command) == 0 
        or die "$0: $command[0] failed with exit status ", ($? >> 8), "\n";
}

# Forwards the user's .Xauthority file to the remote machine using rcp.  If
# the remote machine requires an AFS token, the user's .cshrc has to obtain it
# automatically for this to work.  The remote machine will have a ticket by
# the time this is run.
sub forward_xauth {
    my ($host) = @_;
    my @command = ($PATH{rcp}, '-p');
    push (@command, '-x') unless $CONFIG{noencrypt};
    my $remote = ($CONFIG{login} ? $CONFIG{login} . '@' : "") . "$host:~";
    push (@command, "$ENV{HOME}/.Xauthority", $remote);
    print "@command\n" if $CONFIG{verbose};
    if (system (@command) == 0) {
        print "$PATH{rcp}: .Xauthority file forwarded to $host\n";
    } else {
        warn "$0: $command[0] failed with exit status ", ($? >> 8), "\n";
    }
}

##############################################################################
# rlogin and telnet
##############################################################################

# Do the actual rlogin to the remote host, using the saved options string from
# the option parse.
sub rlogin {
    my ($host) = @_;
    my @command = ($PATH{rlogin}, $host, @{$CONFIG{options}});
    print "@command\n" if $CONFIG{verbose};
    exec @command or die "$0: could not execute $command[0]: $!\n";
}

# Do the actual telnet to the remote host, using the saved options string from
# the option parse.
sub telnet {
    my ($host, $port) = @_;
    my @command = ($PATH{telnet}, @{$CONFIG{options}}, $host);
    push (@command, $port) if $port;
    print "@command\n" if $CONFIG{verbose};
    exec @command or die "$0: could not execute $command[0]: $!\n";
}

##############################################################################
# Main routine
##############################################################################

# Trim extraneous path garbage from the program name.
$0 =~ s%.*/%%;

# Find the programs we care about.
find_programs;

# Parse the command line options to determine what to do.
parse_options;

# Optionally forward our ticket and Xauthority file.
forward_ticket ($CONFIG{host}) unless $CONFIG{noforward};
forward_xauth ($CONFIG{host}) if $CONFIG{xauth};

# Do the actual telnet or rlogin.
if ($CONFIG{'telnet'}) {
    telnet ($CONFIG{host}, $CONFIG{port});
} else {
    rlogin ($CONFIG{host});
}

##############################################################################
# Documentation
##############################################################################

=head1 NAME

klogin, ktelnet - Kerberos rlogin or telnet with v4 ticket forwarding

=head1 SYNOPSIS

klogin [B<-AfhTVvx>] [B<-l> I<username>] [rlogin options] I<host> [I<port>]

ktelnet [B<-AfhVvx>] [B<-l> I<username>] [telnet options] I<host> [I<port>]

=head1 DESCRIPTION

B<klogin> forwards your Kerberos ticket-granting ticket to the machine
I<host> using kftgt(1) and then connects to that machine using Kerberos
rlogin.  If invoked with the B<-T> option or as B<ktelnet>, it uses Kerberos
telnet instead, and also takes an optional I<port> argument to connect to a
non-standard port.

By default, B<klogin> always uses encryption (the B<-x> option to rlogin or
telnet) and always forwards forwardable Kerberos v5 tickets (the B<-F>
option).  When invoking telnet, B<klogin> always passes the B<-a> flag to
tell telnet to automatically log on to the remote system.

You can also give B<klogin> any options supported by either telnet or rlogin
and then will be passed to telnet or rlogin as appropriate.  Note, however,
that the B<-a> option to telnet isn't recognized because B<klogin> always
uses B<-a> when using telnet, and the meanings of the B<-f>, B<-F>, and
B<-x> flags are reversed (see below).

The host given to B<klogin> is put through a forward and then reverse DNS
lookup before being used, to resolve any CNAMEs to their canonical hosts and
to handle load-balanced hosts or hosts with multiple A records.

=head1 OPTIONS

=over 4

=item B<-f>

Don't forward tickets to the remote host.  This both tells B<klogin> not to
run kftgt(1) and tells it not to pass either B<-f> or B<-F> to rlogin or
telnet so that Kerberos v5 tickets won't be forwarded.

=item B<-F>

Don't forward forwardable Kerberos v5 tickets.  This tells B<klogin> to pass
the B<-f> option to telnet or rlogin rather than B<-F>.  Kerberos v4 tickets
will still be forwarded, as will Kerberos v5 tickets, but the forwarded
Kerberos v5 tickets cannot be forwarded to another host.

=item B<--help>, B<-h>

Print a summary of options and exit.

=item B<--login>=I<username>, B<-l> I<username>

Set the username on the remote system to I<username>.  This is the user to
log in as as well as user to which to forward tickets.  If this option is
not given, the default will be the username on the local host.  This option
will often be necessary if the local username differs from the Kerberos
principal name, since B<kftgt> and B<rlogin> differ on the default
otherwise.

=item B<--telnet>, B<-T>

Use telnet rather than rlogin.  Using this option has the same effect as
invoking B<klogin> as B<ktelnet>.

=item B<--verbose>, B<-V>

Print out each command and the arguments used before it's executed.

=item B<--version>, B<-v>

Print the version number of B<klogin> and exit.

=item B<-x>

Don't use encryption.  Use of this option is not recommended, as anything
sent through the resulting connection can be read by a potential attacker.

=item B<--xauth>, B<-A>

Try to forward the .Xauthority file to the remote host.  This is done using
B<rcp> and the .Xauthority file on the remote system will be overwritten,
not merged.  Note that if the remote system uses AFS as its file system,
your dotfiles must be set up so that rcp to that system after a ticket has
been forwarded will acquire a token and be able to write to your home
directory.

=back

In addition, B<klogin> tries to recognize rlogin and telnet options and pass
them along to rlogin or telnet as appropriate.

=head1 CAVEATS

See kftgt(1) for some additional details about Kerberos v4 ticket forwarding
and some of the peculiarities thereof.

=head1 AUTHORS

B<klogin> was originally written by Roland Schemers <schemers@stanford.edu>
and updated and maintained by Larry Schwimmer <opusl@stanford.edu>.  It was
rewritten completely by Russ Allbery <rra@stanford.edu>.

Questions and bug reports may be sent to Russ Allbery <rra@stanford.edu>,
but please be aware that we only support Stanford affiliates and may not be
able to help with problems at other sites.

=head1 LICENSE

Copyright 1994, 1996, 1997, 1999, 2001, 2002, 2003, 2005 Board of Trustees,
Leland Stanford Jr. University
  
All rights reserved.
  
Export of this software from the United States of America may require a
specific license from the United States Government.  It is the
responsibility of any person or organization contemplating export to obtain
such a license before exporting.

WITHIN THAT CONSTRAINT, permission to use, copy, modify, and distribute this
software and its documentation for any purpose and without fee is hereby
granted, provided that the above copyright notice appear in all copies and
that both that copyright notice and this permission notice appear in
supporting documentation, and that the name of Stanford University not be
used in advertising or publicity pertaining to distribution of the software
without specific, written prior permission.  Stanford University makes no
representations about the suitability of this software for any purpose.  It
is provided "as is" without express or implied warranty.

THIS SOFTWARE IS PROVIDED "AS IS" AND WITHOUT ANY EXPRESS OR IMPLIED
WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

=head1 SEE ALSO

kftgt(1), rlogin(1), telnet(1)

=cut