キーの打ち方によってユーザーを識別し、検証する

                
## remove lines:
  printPassword( \@keysOne );

  readPassword( \@keysTwo, "Confirm the");
  printPassword( \@keysTwo );

  my $catch = <STDIN>  #initial password catch
     $catch = <STDIN>  #confirmation password catch

  next unless( charactersMatch() );
  next unless( totalTimeOK() );
  next unless( hasNonPrintable() );
  next unless( individualKeyTimingsOK() );

  $passwordOK = 1;

## insert line:
  printCharacteristics();

                
sub printCharacteristics
{
  my $count = 0;
  my $sig1 = "";

  while( $count < ($#keysOne) )
  {
    my( $time1, undef, undef) = split " ", $keysOne[$count];
    my( $time2, undef, undef) = split " ", $keysOne[$count+1];
    my $timeDiff_0 = $time2 - $time1;

    $sig1 .= substr( $timeDiff_0, 0, length($timeDiff_0)-1) . " ";
    $count++;
  }

  $sig1 = substr($sig1,0,length($sig1)-1);

  map { print "", (split " ", $_)[1]; } @keysOne;

  my $val =`echo "$sig1" | mkpasswd -H md5 --stdin`;
  print " ", substr($val,0,11) , " ";
  print substr($val,11);
  print "\n";
  print "$sig1\n";

}#printCharacteristics

                
#change line:
if( $inLine =~ /KeyPress event/ || $inLine =~ /KeyRelease event/ )
#to:
if(  $inLine =~ /KeyRelease event/ )

                
#change lines:
      # get the time entry
      my $currTime = <XEV>

#to:
      # get the time entry
      my $currTime = <XEV>
      # certain configurations require this additional read
      $currTime = <XEV>  if( $currTime !~ /time / );

                
Enter a password:
nathan

nathan $1$Ag51/gt5 $WBcCKPxP5xnbDu2S5BbNt.

24 26 13 23 11
Enter a password:
nathan

nathan $1$gva6aFYD $oZhayCi3AdVXsuyQ0uBFg0

26 26 11 22 11
Enter a password:

                
#include <crypt.h>
int g_in_username_mode = 1;  // check only username dynamics
int g_dynamics_loaded = 0;   // loaded /etc/shadow.dynamics file ok
int g_name_index = -1;       // current username index in /etc/shadow.dynamics
int g_matched_dynamics = 0;  // username dyanmics match the stored dynamics

guint32 g_release_time[500]; // maximum five hundred key release events
int g_release_count = 0;     // total number of key release events
int g_sig[500];              // maximum five hundred intra key timings
int g_range = 2;             // search range for dynamics match
int g_user_count = 0;        // current number of users in /etc/shadow.dynamics

struct g_user
{
  char username[50];
  char salt[50];
  char password[50];
  char salty_password[50];
};

struct g_user g_user_dynamics[500];  // maximum five hundred users

                
void load_shadow_dynamics(void);
char * check_dynamics( char *, int);

                
void load_shadow_dynamics(void)
{
  FILE *fp;
  struct stat f_status;
  int retcode;
  char *shadow_file;
  shadow_file = "/etc/shadow.dynamics";

  fp = NULL;
  VE_IGNORE_EINTR (retcode = g_lstat (shadow_file, &f_status));

  // make sure it's a 'normal' file     
  if (retcode == 0) 
  {
    if (S_ISREG (f_status.st_mode)) 
    {
      g_dynamics_loaded = 1;
      VE_IGNORE_EINTR (fp = fopen (shadow_file, "r"));
    }           
  }

  if( fp != NULL )
  {
    char * line = NULL;
    size_t len = 0;
    ssize_t  read;
    while((read = getline(&line, &len, fp)) != -1 )
    {
      char username[50] = "";
      char salt[50] = "";
      char password[50] = "";

      if( sscanf( line, "%s %s %s", username, salt, password) == 3 )
      {
        sprintf(g_user_dynamics[g_user_count].username, "%s", username);
        sprintf(g_user_dynamics[g_user_count].salt, "%s", salt);
        sprintf(g_user_dynamics[g_user_count].password, "%s", password);
        sprintf(g_user_dynamics[g_user_count].salty_password,
          "%s%s", salt, password);
        g_user_count++;
      }else
      {
        g_dynamics_loaded = 0;
      }//if incorrect dynamics file
    }//while line in
  }//if file pointer is not null

  VE_IGNORE_EINTR (fclose (fp));

}//load_shadow_dynamics

                
// change:
        gtk_label_set_text_with_mnemonic (GTK_LABEL (label), _("_Username:"));
// to:
        if( g_dynamics_loaded == 0 )
          gtk_label_set_text_with_mnemonic (GTK_LABEL (label), 
            _("_Username: (dynamics misconfigured)"));
        else
          gtk_label_set_text_with_mnemonic (GTK_LABEL (label), _("_Username:"));

        g_release_count = 0;
        g_in_username_mode = 1;

                
// change:
            gtk_label_set_text_with_mnemonic (GTK_LABEL (label), _("_Password:"));
// to:
         if( g_dynamics_loaded == 0 )
           gtk_label_set_text_with_mnemonic (GTK_LABEL (label), 
             _("_Password: (dynamics misconfigured)"));
         else
           gtk_label_set_text_with_mnemonic (GTK_LABEL (label), _("_Password:"));

         g_in_username_mode = 0;

                
load_shadow_dynamics();

                
        if( g_in_username_mode == 1 )
        {
          g_release_time[g_release_count] =  event->time;
          g_release_count++;
        }

                
        g_matched_dynamics = 0;
        if( g_in_username_mode == 1 )
        {
          int i =0;
          g_name_index = -1;
          for( i=0; i< g_user_count; i++ )
          {
            if( strcmp( g_user_dynamics[i].username,
                          gtk_entry_get_text(GTK_ENTRY(entry)) ) == 0  )
            {
              g_name_index = i;
              i = g_user_count; // to exit the loop
            }
          }//for each username read from file

          // require at least two key presses to measure
          if( g_name_index != -1 && g_release_count >= 2 )
          {
            i=0;
            for( i=0; i< g_release_count-1; i++ )
            {
              char sig_num[50] = "";
              sprintf( sig_num, "%u", abs(g_release_time[i] - g_release_time[i+1]) );

              char clip_str[50] = "";
              strncat( clip_str, sig_num, strlen(sig_num)-1 );
              g_sig[i] = atoi( clip_str );
            }//for each i

            check_dynamics("", 0);
          }

          if( g_matched_dynamics != 1 )
          {
            // name not found, set username to garbage value to ensure no-login
            // this way you can't defeat keystroke dynamics checks by removing an
            // entry from the /etc/shadow.dynamics file
            //  -comment this line out if you want to enable non-dynamics protected
            //  logins
            gtk_entry_set_text (GTK_ENTRY (entry), " ");
          }

        }// if in username mode

                
char * check_dynamics( char * in_string, int level )
{       
  int start = g_sig[level] - g_range;
  int stop  = g_sig[level] + g_range;
  int curr  = start;
         
  // eliminate the g_matched_dynamics != 1 check to enforce consistent 
  // processing time regardless of when the match is found.  In theory, this 
  // will reduce the ability to perceive a dynamics match due to processing 
  // time - which becomes much more effective for longer usernames or greater
  // g_range values

  while( curr <= stop && g_matched_dynamics != 1 )
  {
    if( level == (g_release_count-2) )
    {
      // if deepest level, perform match check
      char current_timing[500];
      char current_salt[50];

      sprintf( current_timing, "%s %d", in_string, curr);
      sprintf( current_salt, "%s", g_user_dynamics[g_name_index].salt);
      char * crypt_pass = crypt( current_timing, current_salt);

      if( strcmp(crypt_pass, g_user_dynamics[g_name_index].salty_password) == 0)
        g_matched_dynamics = 1;

    }else
    {
      // append to the current 'signature', go to next level
      char test_pass[500] = "";
      if( strlen(in_string) != 0 )
        sprintf(test_pass,"%s %d", in_string, curr);
      else
        sprintf(test_pass,"%d", curr);

      check_dynamics( test_pass, level+1);
    }//if at maximum level
    
    curr++;

  }//while current < stop

  return("");

}//check_dynamics

                
    make  all-recursive
    make[1]: Entering directory `/home/nathan/gdm-2.20.3'
    Making all in po
    make[2]: Entering directory `/home/nathan/gdm-2.20.3/po'
    file=`echo af | sed 's,.*/,,'`.gmo \
              && rm -f $file  &&  -o $file af.po
    /bin/sh: -o: not found
    make[2]: *** [af.gmo] Error 127
    make[2]: Leaving directory `/home/nathan/gdm-2.20.3/po'
    make[1]: *** [all-recursive] Error 1
    make[1]: Leaving directory `/home/nathan/gdm-2.20.3'
    make: *** [all] Error 2

                
# change:
SUBDIRS = \
  po      \
  config      \
# to:
SUBDIRS = \
  config      \