diff options
100 files changed, 1852 insertions, 5669 deletions
diff --git a/crypto/openssh/acconfig.h b/crypto/openssh/acconfig.h index 02e9e4f..a42facf 100644 --- a/crypto/openssh/acconfig.h +++ b/crypto/openssh/acconfig.h @@ -1,4 +1,4 @@ -/* $Id: acconfig.h,v 1.177 2004/04/15 23:22:40 dtucker Exp $ */ +/* $Id: acconfig.h,v 1.180 2004/08/16 13:12:06 dtucker Exp $ */ /* $FreeBSD$ */ /* @@ -105,6 +105,9 @@ /* Work around problematic Linux PAM modules handling of PAM_TTY */ #undef PAM_TTY_KLUDGE +/* Define if pam_chauthtok wants real uid set to the unpriv'ed user */ +#undef SSHPAM_CHAUTHTOK_NEEDS_RUID + /* Use PIPES instead of a socketpair() */ #undef USE_PIPES @@ -438,6 +441,12 @@ /* Define if cmsg_type is not passed correctly */ #undef BROKEN_CMSG_TYPE +/* + * Define to whatever link() returns for "not supported" if it doesn't + * return EOPNOTSUPP. + */ +#undef LINK_OPNOTSUPP_ERRNO + /* Strings used in /etc/passwd to denote locked account */ #undef LOCKED_PASSWD_STRING #undef LOCKED_PASSWD_PREFIX @@ -452,6 +461,9 @@ /* Define if your resolver libs need this for getrrsetbyname */ #undef BIND_8_COMPAT +/* Define if you have /proc/$pid/fd */ +#undef HAVE_PROC_PID + @BOTTOM@ /* ******************* Shouldn't need to edit below this line ************** */ diff --git a/crypto/openssh/auth-krb5.c b/crypto/openssh/auth-krb5.c index 42b8026..acd2dda 100644 --- a/crypto/openssh/auth-krb5.c +++ b/crypto/openssh/auth-krb5.c @@ -70,6 +70,7 @@ auth_krb5_password(Authctxt *authctxt, const char *password) krb5_principal server; char ccname[40]; int tmpfd; + mode_t old_umask; #endif krb5_error_code problem; krb5_ccache ccache = NULL; @@ -148,7 +149,10 @@ auth_krb5_password(Authctxt *authctxt, const char *password) snprintf(ccname,sizeof(ccname),"FILE:/tmp/krb5cc_%d_XXXXXX",geteuid()); - if ((tmpfd = mkstemp(ccname+strlen("FILE:")))==-1) { + old_umask = umask(0177); + tmpfd = mkstemp(ccname + strlen("FILE:")); + umask(old_umask); + if (tmpfd == -1) { logit("mkstemp(): %.100s", strerror(errno)); problem = errno; goto out; diff --git a/crypto/openssh/auth-pam.c b/crypto/openssh/auth-pam.c index 9e30219..7690c38 100644 --- a/crypto/openssh/auth-pam.c +++ b/crypto/openssh/auth-pam.c @@ -28,10 +28,26 @@ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. */ +/* + * Copyright (c) 2003,2004 Damien Miller <djm@mindrot.org> + * Copyright (c) 2003,2004 Darren Tucker <dtucker@zip.com.au> + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ /* Based on $xFreeBSD: src/crypto/openssh/auth2-pam-freebsd.c,v 1.11 2003/03/31 13:48:18 des Exp $ */ #include "includes.h" -RCSID("$Id: auth-pam.c,v 1.100 2004/04/18 01:00:26 dtucker Exp $"); +RCSID("$Id: auth-pam.c,v 1.114 2004/08/16 13:12:06 dtucker Exp $"); RCSID("$FreeBSD$"); #ifdef USE_PAM @@ -50,7 +66,7 @@ RCSID("$FreeBSD$"); #include "monitor_wrap.h" #include "msg.h" #include "packet.h" -#include "readpass.h" +#include "misc.h" #include "servconf.h" #include "ssh2.h" #include "xmalloc.h" @@ -94,10 +110,17 @@ static mysig_t sshpam_oldsig; static void sshpam_sigchld_handler(int sig) { + signal(SIGCHLD, SIG_DFL); if (cleanup_ctxt == NULL) return; /* handler called after PAM cleanup, shouldn't happen */ - if (waitpid(cleanup_ctxt->pam_thread, &sshpam_thread_status, 0) == -1) - return; /* couldn't wait for process */ + if (waitpid(cleanup_ctxt->pam_thread, &sshpam_thread_status, WNOHANG) + <= 0) { + /* PAM thread has not exitted, privsep slave must have */ + kill(cleanup_ctxt->pam_thread, SIGTERM); + if (waitpid(cleanup_ctxt->pam_thread, &sshpam_thread_status, 0) + <= 0) + return; /* could not wait */ + } if (WIFSIGNALED(sshpam_thread_status) && WTERMSIG(sshpam_thread_status) == SIGTERM) return; /* terminated by pthread_cancel */ @@ -163,6 +186,7 @@ static int sshpam_cred_established = 0; static int sshpam_account_status = -1; static char **sshpam_env = NULL; static Authctxt *sshpam_authctxt = NULL; +static const char *sshpam_password = NULL; /* Some PAM implementations don't implement this */ #ifndef HAVE_PAM_GETENVLIST @@ -178,8 +202,33 @@ pam_getenvlist(pam_handle_t *pamh) } #endif +/* + * Some platforms, notably Solaris, do not enforce password complexity + * rules during pam_chauthtok() if the real uid of the calling process + * is 0, on the assumption that it's being called by "passwd" run by root. + * This wraps pam_chauthtok and sets/restore the real uid so PAM will do + * the right thing. + */ +#ifdef SSHPAM_CHAUTHTOK_NEEDS_RUID +static int +sshpam_chauthtok_ruid(pam_handle_t *pamh, int flags) +{ + int result; + + if (sshpam_authctxt == NULL) + fatal("PAM: sshpam_authctxt not initialized"); + if (setreuid(sshpam_authctxt->pw->pw_uid, -1) == -1) + fatal("%s: setreuid failed: %s", __func__, strerror(errno)); + result = pam_chauthtok(pamh, flags); + if (setreuid(0, -1) == -1) + fatal("%s: setreuid failed: %s", __func__, strerror(errno)); + return result; +} +# define pam_chauthtok(a,b) (sshpam_chauthtok_ruid((a), (b))) +#endif + void -pam_password_change_required(int reqd) +sshpam_password_change_required(int reqd) { debug3("%s %d", __func__, reqd); if (sshpam_authctxt == NULL) @@ -209,7 +258,7 @@ import_environments(Buffer *b) #ifndef USE_POSIX_THREADS /* Import variables set by do_pam_account */ sshpam_account_status = buffer_get_int(b); - pam_password_change_required(buffer_get_int(b)); + sshpam_password_change_required(buffer_get_int(b)); /* Import environment from subprocess */ num_env = buffer_get_int(b); @@ -241,7 +290,7 @@ import_environments(Buffer *b) * Conversation function for authentication thread. */ static int -sshpam_thread_conv(int n, const struct pam_message **msg, +sshpam_thread_conv(int n, struct pam_message **msg, struct pam_response **resp, void *data) { Buffer buffer; @@ -252,6 +301,10 @@ sshpam_thread_conv(int n, const struct pam_message **msg, debug3("PAM: %s entering, %d messages", __func__, n); *resp = NULL; + if (data == NULL) { + error("PAM: conversation function passed a null context"); + return (PAM_CONV_ERR); + } ctxt = data; if (n <= 0 || n > PAM_MAX_NUM_MSG) return (PAM_CONV_ERR); @@ -329,15 +382,21 @@ sshpam_thread(void *ctxtp) struct pam_ctxt *ctxt = ctxtp; Buffer buffer; struct pam_conv sshpam_conv; + int flags = (options.permit_empty_passwd == 0 ? + PAM_DISALLOW_NULL_AUTHTOK : 0); #ifndef USE_POSIX_THREADS extern char **environ; char **env_from_pam; u_int i; const char *pam_user; - pam_get_item(sshpam_handle, PAM_USER, (const void **)&pam_user); - setproctitle("%s [pam]", pam_user); + pam_get_item(sshpam_handle, PAM_USER, (void **)&pam_user); environ[0] = NULL; + + if (sshpam_authctxt != NULL) { + setproctitle("%s [pam]", + sshpam_authctxt->valid ? pam_user : "unknown"); + } #endif sshpam_conv.conv = sshpam_thread_conv; @@ -351,7 +410,7 @@ sshpam_thread(void *ctxtp) (const void *)&sshpam_conv); if (sshpam_err != PAM_SUCCESS) goto auth_fail; - sshpam_err = pam_authenticate(sshpam_handle, 0); + sshpam_err = pam_authenticate(sshpam_handle, flags); if (sshpam_err != PAM_SUCCESS) goto auth_fail; @@ -363,7 +422,7 @@ sshpam_thread(void *ctxtp) PAM_CHANGE_EXPIRED_AUTHTOK); if (sshpam_err != PAM_SUCCESS) goto auth_fail; - pam_password_change_required(0); + sshpam_password_change_required(0); } } @@ -423,7 +482,7 @@ sshpam_thread_cleanup(void) } static int -sshpam_null_conv(int n, const struct pam_message **msg, +sshpam_null_conv(int n, struct pam_message **msg, struct pam_response **resp, void *data) { debug3("PAM: %s entering, %d messages", __func__, n); @@ -461,7 +520,7 @@ sshpam_init(Authctxt *authctxt) if (sshpam_handle != NULL) { /* We already have a PAM context; check if the user matches */ sshpam_err = pam_get_item(sshpam_handle, - PAM_USER, (const void **)&pam_user); + PAM_USER, (void **)&pam_user); if (sshpam_err == PAM_SUCCESS && strcmp(user, pam_user) == 0) return (0); pam_end(sshpam_handle, sshpam_err); @@ -713,7 +772,7 @@ do_pam_account(void) } if (sshpam_err == PAM_NEW_AUTHTOK_REQD) - pam_password_change_required(1); + sshpam_password_change_required(1); sshpam_account_status = 1; return (sshpam_account_status); @@ -759,7 +818,7 @@ do_pam_setcred(int init) } static int -pam_tty_conv(int n, const struct pam_message **msg, +sshpam_tty_conv(int n, struct pam_message **msg, struct pam_response **resp, void *data) { char input[PAM_MAX_MSG_SIZE]; @@ -788,7 +847,8 @@ pam_tty_conv(int n, const struct pam_message **msg, case PAM_PROMPT_ECHO_ON: fprintf(stderr, "%s\n", PAM_MSG_MEMBER(msg, i, msg)); fgets(input, sizeof input, stdin); - reply[i].resp = xstrdup(input); + if ((reply[i].resp = strdup(input)) == NULL) + goto fail; reply[i].resp_retcode = PAM_SUCCESS; break; case PAM_ERROR_MSG: @@ -812,7 +872,7 @@ pam_tty_conv(int n, const struct pam_message **msg, return (PAM_CONV_ERR); } -static struct pam_conv tty_conv = { pam_tty_conv, NULL }; +static struct pam_conv tty_conv = { sshpam_tty_conv, NULL }; /* * XXX this should be done in the authentication phase, but ssh1 doesn't @@ -836,7 +896,7 @@ do_pam_chauthtok(void) } static int -pam_store_conv(int n, const struct pam_message **msg, +sshpam_store_conv(int n, struct pam_message **msg, struct pam_response **resp, void *data) { struct pam_response *reply; @@ -878,7 +938,7 @@ pam_store_conv(int n, const struct pam_message **msg, return (PAM_CONV_ERR); } -static struct pam_conv store_conv = { pam_store_conv, NULL }; +static struct pam_conv store_conv = { sshpam_store_conv, NULL }; void do_pam_session(void) @@ -945,4 +1005,112 @@ free_pam_environment(char **env) xfree(env); } +/* + * "Blind" conversation function for password authentication. Assumes that + * echo-off prompts are for the password and stores messages for later + * display. + */ +static int +sshpam_passwd_conv(int n, struct pam_message **msg, + struct pam_response **resp, void *data) +{ + struct pam_response *reply; + int i; + size_t len; + + debug3("PAM: %s called with %d messages", __func__, n); + + *resp = NULL; + + if (n <= 0 || n > PAM_MAX_NUM_MSG) + return (PAM_CONV_ERR); + + if ((reply = malloc(n * sizeof(*reply))) == NULL) + return (PAM_CONV_ERR); + memset(reply, 0, n * sizeof(*reply)); + + for (i = 0; i < n; ++i) { + switch (PAM_MSG_MEMBER(msg, i, msg_style)) { + case PAM_PROMPT_ECHO_OFF: + if (sshpam_password == NULL) + goto fail; + if ((reply[i].resp = strdup(sshpam_password)) == NULL) + goto fail; + reply[i].resp_retcode = PAM_SUCCESS; + break; + case PAM_ERROR_MSG: + case PAM_TEXT_INFO: + len = strlen(PAM_MSG_MEMBER(msg, i, msg)); + if (len > 0) { + buffer_append(&loginmsg, + PAM_MSG_MEMBER(msg, i, msg), len); + buffer_append(&loginmsg, "\n", 1); + } + if ((reply[i].resp = strdup("")) == NULL) + goto fail; + reply[i].resp_retcode = PAM_SUCCESS; + break; + default: + goto fail; + } + } + *resp = reply; + return (PAM_SUCCESS); + + fail: + for(i = 0; i < n; i++) { + if (reply[i].resp != NULL) + xfree(reply[i].resp); + } + xfree(reply); + return (PAM_CONV_ERR); +} + +static struct pam_conv passwd_conv = { sshpam_passwd_conv, NULL }; + +/* + * Attempt password authentication via PAM + */ +int +sshpam_auth_passwd(Authctxt *authctxt, const char *password) +{ + int flags = (options.permit_empty_passwd == 0 ? + PAM_DISALLOW_NULL_AUTHTOK : 0); + static char badpw[] = "\b\n\r\177INCORRECT"; + + if (!options.use_pam || sshpam_handle == NULL) + fatal("PAM: %s called when PAM disabled or failed to " + "initialise.", __func__); + + sshpam_password = password; + sshpam_authctxt = authctxt; + + /* + * If the user logging in is invalid, or is root but is not permitted + * by PermitRootLogin, use an invalid password to prevent leaking + * information via timing (eg if the PAM config has a delay on fail). + */ + if (!authctxt->valid || (authctxt->pw->pw_uid == 0 && + options.permit_root_login != PERMIT_YES)) + sshpam_password = badpw; + + sshpam_err = pam_set_item(sshpam_handle, PAM_CONV, + (const void *)&passwd_conv); + if (sshpam_err != PAM_SUCCESS) + fatal("PAM: %s: failed to set PAM_CONV: %s", __func__, + pam_strerror(sshpam_handle, sshpam_err)); + + sshpam_err = pam_authenticate(sshpam_handle, flags); + sshpam_password = NULL; + if (sshpam_err == PAM_SUCCESS && authctxt->valid) { + debug("PAM: password authentication accepted for %.100s", + authctxt->user); + return 1; + } else { + debug("PAM: password authentication failed for %.100s: %s", + authctxt->valid ? authctxt->user : "an illegal user", + pam_strerror(sshpam_handle, sshpam_err)); + return 0; + } +} #endif /* USE_PAM */ diff --git a/crypto/openssh/auth-pam.h b/crypto/openssh/auth-pam.h index ff4b6f6..b4c3311 100644 --- a/crypto/openssh/auth-pam.h +++ b/crypto/openssh/auth-pam.h @@ -1,4 +1,4 @@ -/* $Id: auth-pam.h,v 1.25 2004/03/08 12:04:07 dtucker Exp $ */ +/* $Id: auth-pam.h,v 1.26 2004/05/30 10:43:59 dtucker Exp $ */ /* $FreeBSD$ */ /* @@ -45,5 +45,6 @@ char ** fetch_pam_child_environment(void); void free_pam_environment(char **); void sshpam_thread_cleanup(void); void sshpam_cleanup(void); +int sshpam_auth_passwd(Authctxt *, const char *); #endif /* USE_PAM */ diff --git a/crypto/openssh/auth-passwd.c b/crypto/openssh/auth-passwd.c index 38f610a..1b39775 100644 --- a/crypto/openssh/auth-passwd.c +++ b/crypto/openssh/auth-passwd.c @@ -65,7 +65,9 @@ auth_password(Authctxt *authctxt, const char *password) { struct passwd * pw = authctxt->pw; int ok = authctxt->valid; +#if defined(USE_SHADOW) && defined(HAS_SHADOW_EXPIRE) static int expire_checked = 0; +#endif #ifndef HAVE_CYGWIN if (pw->pw_uid == 0 && options.permit_root_login != PERMIT_YES) @@ -92,6 +94,10 @@ auth_password(Authctxt *authctxt, const char *password) return ok; } #endif +#ifdef USE_PAM + if (options.use_pam) + return (sshpam_auth_passwd(authctxt, password) && ok); +#endif #if defined(USE_SHADOW) && defined(HAS_SHADOW_EXPIRE) if (!expire_checked) { expire_checked = 1; diff --git a/crypto/openssh/auth-rsa.c b/crypto/openssh/auth-rsa.c index 2f0746b..16369d4 100644 --- a/crypto/openssh/auth-rsa.c +++ b/crypto/openssh/auth-rsa.c @@ -14,7 +14,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: auth-rsa.c,v 1.58 2003/11/04 08:54:09 djm Exp $"); +RCSID("$OpenBSD: auth-rsa.c,v 1.60 2004/06/21 17:36:31 avsm Exp $"); #include <openssl/rsa.h> #include <openssl/md5.h> @@ -23,7 +23,6 @@ RCSID("$OpenBSD: auth-rsa.c,v 1.58 2003/11/04 08:54:09 djm Exp $"); #include "packet.h" #include "xmalloc.h" #include "ssh1.h" -#include "mpaux.h" #include "uidswap.h" #include "match.h" #include "auth-options.h" @@ -204,7 +203,7 @@ auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey) */ while (fgets(line, sizeof(line), f)) { char *cp; - char *options; + char *key_options; linenum++; @@ -222,7 +221,7 @@ auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey) */ if (*cp < '0' || *cp > '9') { int quoted = 0; - options = cp; + key_options = cp; for (; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) { if (*cp == '\\' && cp[1] == '"') cp++; /* Skip both */ @@ -230,7 +229,7 @@ auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey) quoted = !quoted; } } else - options = NULL; + key_options = NULL; /* Parse the key from the line. */ if (hostfile_read_key(&cp, &bits, key) == 0) { @@ -255,7 +254,7 @@ auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey) * If our options do not allow this key to be used, * do not send challenge. */ - if (!auth_parse_options(pw, options, file, linenum)) + if (!auth_parse_options(pw, key_options, file, linenum)) continue; /* break out, this key is allowed */ diff --git a/crypto/openssh/auth.c b/crypto/openssh/auth.c index 6bed01c..624a34a 100644 --- a/crypto/openssh/auth.c +++ b/crypto/openssh/auth.c @@ -23,7 +23,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: auth.c,v 1.51 2003/11/21 11:57:02 djm Exp $"); +RCSID("$OpenBSD: auth.c,v 1.56 2004/07/28 09:40:29 markus Exp $"); RCSID("$FreeBSD$"); #ifdef HAVE_LOGIN_H @@ -48,7 +48,6 @@ RCSID("$FreeBSD$"); #include "buffer.h" #include "bufaux.h" #include "uidswap.h" -#include "tildexpand.h" #include "misc.h" #include "bufaux.h" #include "packet.h" @@ -205,31 +204,10 @@ allowed_user(struct passwd * pw) ga_free(); } -#ifdef WITH_AIXAUTHENTICATE - /* - * Don't check loginrestrictions() for root account (use - * PermitRootLogin to control logins via ssh), or if running as - * non-root user (since loginrestrictions will always fail). - */ - if ((pw->pw_uid != 0) && (geteuid() == 0)) { - char *msg; - - if (loginrestrictions(pw->pw_name, S_RLOGIN, NULL, &msg) != 0) { - int loginrestrict_errno = errno; - - if (msg && *msg) { - buffer_append(&loginmsg, msg, strlen(msg)); - aix_remove_embedded_newlines(msg); - logit("Login restricted for %s: %.100s", - pw->pw_name, msg); - } - /* Don't fail if /etc/nologin set */ - if (!(loginrestrict_errno == EPERM && - stat(_PATH_NOLOGIN, &st) == 0)) - return 0; - } - } -#endif /* WITH_AIXAUTHENTICATE */ +#ifdef CUSTOM_SYS_AUTH_ALLOWED_USER + if (!sys_auth_allowed_user(pw)) + return 0; +#endif /* We found no reason not to let this user try to log on... */ return 1; @@ -244,7 +222,7 @@ auth_log(Authctxt *authctxt, int authenticated, char *method, char *info) /* Raise logging level */ if (authenticated == 1 || !authctxt->valid || - authctxt->failures >= AUTH_FAIL_LOG || + authctxt->failures >= options.max_authtries / 2 || strcmp(method, "password") == 0) authlog = logit; @@ -256,7 +234,7 @@ auth_log(Authctxt *authctxt, int authenticated, char *method, char *info) authlog("%s %s for %s%.100s from %.200s port %d%s", authmsg, method, - authctxt->valid ? "" : "illegal user ", + authctxt->valid ? "" : "invalid user ", authctxt->user, get_remote_ipaddr(), get_remote_port(), @@ -485,7 +463,7 @@ getpwnamallow(const char *user) pw = getpwnam(user); if (pw == NULL) { - logit("Illegal user %.100s from %.100s", + logit("Invalid user %.100s from %.100s", user, get_remote_ipaddr()); #ifdef CUSTOM_FAILED_LOGIN record_failed_login(user, "ssh"); @@ -564,8 +542,8 @@ fakepw(void) fake.pw_passwd = "$2a$06$r3.juUaHZDlIbQaO2dS9FuYxL1W9M81R1Tc92PoSNmzvpEqLkLGrK"; fake.pw_gecos = "NOUSER"; - fake.pw_uid = -1; - fake.pw_gid = -1; + fake.pw_uid = (uid_t)-1; + fake.pw_gid = (gid_t)-1; #ifdef HAVE_PW_CLASS_IN_PASSWD fake.pw_class = ""; #endif diff --git a/crypto/openssh/auth.h b/crypto/openssh/auth.h index 83841b6..b7639d9 100644 --- a/crypto/openssh/auth.h +++ b/crypto/openssh/auth.h @@ -1,4 +1,4 @@ -/* $OpenBSD: auth.h,v 1.49 2004/01/30 09:48:57 markus Exp $ */ +/* $OpenBSD: auth.h,v 1.50 2004/05/23 23:59:53 dtucker Exp $ */ /* $FreeBSD$ */ /* @@ -182,8 +182,6 @@ void auth_debug_reset(void); struct passwd *fakepw(void); -#define AUTH_FAIL_MAX 6 -#define AUTH_FAIL_LOG (AUTH_FAIL_MAX/2) #define AUTH_FAIL_MSG "Too many authentication failures for %.100s" #ifdef SKEY diff --git a/crypto/openssh/auth1.c b/crypto/openssh/auth1.c index 7dd3a4a..806c173 100644 --- a/crypto/openssh/auth1.c +++ b/crypto/openssh/auth1.c @@ -10,7 +10,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: auth1.c,v 1.55 2003/11/08 16:02:40 jakob Exp $"); +RCSID("$OpenBSD: auth1.c,v 1.59 2004/07/28 09:40:29 markus Exp $"); RCSID("$FreeBSD$"); #include "xmalloc.h" @@ -18,7 +18,6 @@ RCSID("$FreeBSD$"); #include "ssh1.h" #include "packet.h" #include "buffer.h" -#include "mpaux.h" #include "log.h" #include "servconf.h" #include "compat.h" @@ -71,10 +70,9 @@ do_authloop(Authctxt *authctxt) u_int dlen; u_int ulen; int prev, type = 0; - struct passwd *pw = authctxt->pw; debug("Attempting authentication for %s%.100s.", - authctxt->valid ? "" : "illegal user ", authctxt->user); + authctxt->valid ? "" : "invalid user ", authctxt->user); /* If the user has no password, accept authentication immediately. */ if (options.password_authentication && @@ -82,8 +80,13 @@ do_authloop(Authctxt *authctxt) (!options.kerberos_authentication || options.kerberos_or_local_passwd) && #endif PRIVSEP(auth_password(authctxt, ""))) { - auth_log(authctxt, 1, "without authentication", ""); - return; +#ifdef USE_PAM + if (options.use_pam && (PRIVSEP(do_pam_account()))) +#endif + { + auth_log(authctxt, 1, "without authentication", ""); + return; + } } /* Indicate that authentication is needed. */ @@ -234,9 +237,10 @@ do_authloop(Authctxt *authctxt) #ifdef HAVE_CYGWIN if (authenticated && - !check_nt_auth(type == SSH_CMSG_AUTH_PASSWORD, pw)) { + !check_nt_auth(type == SSH_CMSG_AUTH_PASSWORD, + authctxt->pw)) { packet_disconnect("Authentication rejected for uid %d.", - pw == NULL ? -1 : pw->pw_uid); + authctxt->pw == NULL ? -1 : authctxt->pw->pw_uid); authenticated = 0; } #else @@ -263,7 +267,7 @@ do_authloop(Authctxt *authctxt) if (authenticated) return; - if (authctxt->failures++ > AUTH_FAIL_MAX) + if (authctxt->failures++ > options.max_authtries) packet_disconnect(AUTH_FAIL_MSG, authctxt->user); packet_start(SSH_SMSG_FAILURE); @@ -299,11 +303,11 @@ do_authentication(Authctxt *authctxt) if ((authctxt->pw = PRIVSEP(getpwnamallow(user))) != NULL) authctxt->valid = 1; else { - debug("do_authentication: illegal user %s", user); + debug("do_authentication: invalid user %s", user); authctxt->pw = fakepw(); } - setproctitle("%s%s", authctxt->pw ? user : "unknown", + setproctitle("%s%s", authctxt->valid ? user : "unknown", use_privsep ? " [net]" : ""); #ifdef USE_PAM diff --git a/crypto/openssh/auth2-chall.c b/crypto/openssh/auth2-chall.c index 4e2a0f9..788c6c6 100644 --- a/crypto/openssh/auth2-chall.c +++ b/crypto/openssh/auth2-chall.c @@ -23,7 +23,7 @@ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #include "includes.h" -RCSID("$OpenBSD: auth2-chall.c,v 1.20 2002/06/30 21:59:45 deraadt Exp $"); +RCSID("$OpenBSD: auth2-chall.c,v 1.21 2004/06/01 14:20:45 dtucker Exp $"); RCSID("$FreeBSD$"); #include "ssh2.h" @@ -32,7 +32,6 @@ RCSID("$FreeBSD$"); #include "packet.h" #include "xmalloc.h" #include "dispatch.h" -#include "auth.h" #include "log.h" static int auth2_challenge_start(Authctxt *); diff --git a/crypto/openssh/auth2.c b/crypto/openssh/auth2.c index 756f33c..089ea34 100644 --- a/crypto/openssh/auth2.c +++ b/crypto/openssh/auth2.c @@ -23,7 +23,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: auth2.c,v 1.104 2003/11/04 08:54:09 djm Exp $"); +RCSID("$OpenBSD: auth2.c,v 1.107 2004/07/28 09:40:29 markus Exp $"); RCSID("$FreeBSD$"); #include "canohost.h" @@ -168,14 +168,14 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt) PRIVSEP(start_pam(authctxt)); #endif } else { - logit("input_userauth_request: illegal user %s", user); + logit("input_userauth_request: invalid user %s", user); authctxt->pw = fakepw(); #ifdef USE_PAM if (options.use_pam) PRIVSEP(start_pam(authctxt)); #endif } - setproctitle("%s%s", authctxt->pw ? user : "unknown", + setproctitle("%s%s", authctxt->valid ? user : "unknown", use_privsep ? " [net]" : ""); authctxt->service = xstrdup(service); authctxt->style = style ? xstrdup(style) : NULL; @@ -273,7 +273,7 @@ userauth_finish(Authctxt *authctxt, int authenticated, char *method) /* now we can break out */ authctxt->success = 1; } else { - if (authctxt->failures++ > AUTH_FAIL_MAX) + if (authctxt->failures++ > options.max_authtries) packet_disconnect(AUTH_FAIL_MSG, authctxt->user); methods = authmethods_get(); packet_start(SSH2_MSG_USERAUTH_FAILURE); diff --git a/crypto/openssh/authfd.c b/crypto/openssh/authfd.c index 42ca082..662350c 100644 --- a/crypto/openssh/authfd.c +++ b/crypto/openssh/authfd.c @@ -35,7 +35,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: authfd.c,v 1.63 2003/11/21 11:57:03 djm Exp $"); +RCSID("$OpenBSD: authfd.c,v 1.64 2004/08/11 21:44:31 avsm Exp $"); #include <openssl/evp.h> @@ -133,16 +133,9 @@ ssh_request_reply(AuthenticationConnection *auth, Buffer *request, Buffer *reply * Wait for response from the agent. First read the length of the * response packet. */ - len = 4; - while (len > 0) { - l = read(auth->fd, buf + 4 - len, len); - if (l == -1 && (errno == EAGAIN || errno == EINTR)) - continue; - if (l <= 0) { - error("Error reading response length from authentication socket."); - return 0; - } - len -= l; + if (atomicio(read, auth->fd, buf, 4) != 4) { + error("Error reading response length from authentication socket."); + return 0; } /* Extract the length, and check it for sanity. */ @@ -156,9 +149,7 @@ ssh_request_reply(AuthenticationConnection *auth, Buffer *request, Buffer *reply l = len; if (l > sizeof(buf)) l = sizeof(buf); - l = read(auth->fd, buf, l); - if (l == -1 && (errno == EAGAIN || errno == EINTR)) - continue; + l = atomicio(read, auth->fd, buf, l); if (l <= 0) { error("Error reading response from authentication socket."); return 0; diff --git a/crypto/openssh/authfile.c b/crypto/openssh/authfile.c index 83ddd63..76a60d0 100644 --- a/crypto/openssh/authfile.c +++ b/crypto/openssh/authfile.c @@ -36,7 +36,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: authfile.c,v 1.55 2003/09/18 07:56:05 markus Exp $"); +RCSID("$OpenBSD: authfile.c,v 1.57 2004/06/21 17:36:31 avsm Exp $"); #include <openssl/err.h> #include <openssl/evp.h> @@ -72,7 +72,7 @@ key_save_private_rsa1(Key *key, const char *filename, const char *passphrase, int fd, i, cipher_num; CipherContext ciphercontext; Cipher *cipher; - u_int32_t rand; + u_int32_t rnd; /* * If the passphrase is empty, use SSH_CIPHER_NONE to ease converting @@ -87,9 +87,9 @@ key_save_private_rsa1(Key *key, const char *filename, const char *passphrase, buffer_init(&buffer); /* Put checkbytes for checking passphrase validity. */ - rand = arc4random(); - buf[0] = rand & 0xff; - buf[1] = (rand >> 8) & 0xff; + rnd = arc4random(); + buf[0] = rnd & 0xff; + buf[1] = (rnd >> 8) & 0xff; buf[2] = buf[0]; buf[3] = buf[1]; buffer_append(&buffer, buf, 4); @@ -236,14 +236,16 @@ key_load_public_rsa1(int fd, const char *filename, char **commentp) struct stat st; char *cp; int i; - off_t len; + size_t len; if (fstat(fd, &st) < 0) { error("fstat for key file %.200s failed: %.100s", filename, strerror(errno)); return NULL; } - len = st.st_size; + if (st.st_size > 1*1024*1024) + close(fd); + len = (size_t)st.st_size; /* truncated */ buffer_init(&buffer); cp = buffer_append_space(&buffer, len); @@ -318,7 +320,7 @@ key_load_private_rsa1(int fd, const char *filename, const char *passphrase, char **commentp) { int i, check1, check2, cipher_type; - off_t len; + size_t len; Buffer buffer, decrypted; u_char *cp; CipherContext ciphercontext; @@ -332,7 +334,11 @@ key_load_private_rsa1(int fd, const char *filename, const char *passphrase, close(fd); return NULL; } - len = st.st_size; + if (st.st_size > 1*1024*1024) { + close(fd); + return (NULL); + } + len = (size_t)st.st_size; /* truncated */ buffer_init(&buffer); cp = buffer_append_space(&buffer, len); diff --git a/crypto/openssh/canohost.c b/crypto/openssh/canohost.c index a0067af..8ad684d 100644 --- a/crypto/openssh/canohost.c +++ b/crypto/openssh/canohost.c @@ -12,7 +12,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: canohost.c,v 1.38 2003/09/23 20:17:11 markus Exp $"); +RCSID("$OpenBSD: canohost.c,v 1.41 2004/07/21 11:51:29 djm Exp $"); #include "packet.h" #include "xmalloc.h" @@ -28,7 +28,7 @@ static void ipv64_normalise_mapped(struct sockaddr_storage *, socklen_t *); */ static char * -get_remote_hostname(int socket, int use_dns) +get_remote_hostname(int sock, int use_dns) { struct sockaddr_storage from; int i; @@ -39,13 +39,13 @@ get_remote_hostname(int socket, int use_dns) /* Get IP address of client. */ fromlen = sizeof(from); memset(&from, 0, sizeof(from)); - if (getpeername(socket, (struct sockaddr *)&from, &fromlen) < 0) { + if (getpeername(sock, (struct sockaddr *)&from, &fromlen) < 0) { debug("getpeername failed: %.100s", strerror(errno)); cleanup_exit(255); } if (from.ss_family == AF_INET) - check_ip_options(socket, ntop); + check_ip_options(sock, ntop); ipv64_normalise_mapped(&from, &fromlen); @@ -138,7 +138,7 @@ get_remote_hostname(int socket, int use_dns) */ /* IPv4 only */ static void -check_ip_options(int socket, char *ipaddr) +check_ip_options(int sock, char *ipaddr) { #ifdef IP_OPTIONS u_char options[200]; @@ -152,7 +152,7 @@ check_ip_options(int socket, char *ipaddr) else ipproto = IPPROTO_IP; option_size = sizeof(options); - if (getsockopt(socket, ipproto, IP_OPTIONS, options, + if (getsockopt(sock, ipproto, IP_OPTIONS, options, &option_size) >= 0 && option_size != 0) { text[0] = '\0'; for (i = 0; i < option_size; i++) @@ -227,7 +227,7 @@ get_canonical_hostname(int use_dns) * The returned string must be freed. */ static char * -get_socket_address(int socket, int remote, int flags) +get_socket_address(int sock, int remote, int flags) { struct sockaddr_storage addr; socklen_t addrlen; @@ -238,11 +238,11 @@ get_socket_address(int socket, int remote, int flags) memset(&addr, 0, sizeof(addr)); if (remote) { - if (getpeername(socket, (struct sockaddr *)&addr, &addrlen) + if (getpeername(sock, (struct sockaddr *)&addr, &addrlen) < 0) return NULL; } else { - if (getsockname(socket, (struct sockaddr *)&addr, &addrlen) + if (getsockname(sock, (struct sockaddr *)&addr, &addrlen) < 0) return NULL; } @@ -261,29 +261,29 @@ get_socket_address(int socket, int remote, int flags) } char * -get_peer_ipaddr(int socket) +get_peer_ipaddr(int sock) { char *p; - if ((p = get_socket_address(socket, 1, NI_NUMERICHOST)) != NULL) + if ((p = get_socket_address(sock, 1, NI_NUMERICHOST)) != NULL) return p; return xstrdup("UNKNOWN"); } char * -get_local_ipaddr(int socket) +get_local_ipaddr(int sock) { char *p; - if ((p = get_socket_address(socket, 0, NI_NUMERICHOST)) != NULL) + if ((p = get_socket_address(sock, 0, NI_NUMERICHOST)) != NULL) return p; return xstrdup("UNKNOWN"); } char * -get_local_name(int socket) +get_local_name(int sock) { - return get_socket_address(socket, 0, NI_NAMEREQD); + return get_socket_address(sock, 0, NI_NAMEREQD); } /* @@ -382,7 +382,13 @@ get_peer_port(int sock) int get_remote_port(void) { - return get_port(0); + static int port = -1; + + /* Cache to avoid getpeername() on a dead connection */ + if (port == -1) + port = get_port(0); + + return port; } int diff --git a/crypto/openssh/channels.c b/crypto/openssh/channels.c index e663c21..1f6984a 100644 --- a/crypto/openssh/channels.c +++ b/crypto/openssh/channels.c @@ -39,7 +39,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: channels.c,v 1.200 2004/01/19 09:24:21 markus Exp $"); +RCSID("$OpenBSD: channels.c,v 1.209 2004/08/11 21:43:04 avsm Exp $"); #include "ssh.h" #include "ssh1.h" @@ -68,7 +68,7 @@ static Channel **channels = NULL; * Size of the channel array. All slots of the array must always be * initialized (at least the type field); unused slots set to NULL */ -static int channels_alloc = 0; +static u_int channels_alloc = 0; /* * Maximum file descriptor value used in any of the channels. This is @@ -141,7 +141,7 @@ channel_lookup(int id) { Channel *c; - if (id < 0 || id >= channels_alloc) { + if (id < 0 || (u_int)id >= channels_alloc) { logit("channel_lookup: %d: bad id", id); return NULL; } @@ -172,6 +172,7 @@ channel_register_fds(Channel *c, int rfd, int wfd, int efd, c->rfd = rfd; c->wfd = wfd; c->sock = (rfd == wfd) ? rfd : -1; + c->ctl_fd = -1; /* XXX: set elsewhere */ c->efd = efd; c->extended_usage = extusage; @@ -208,7 +209,8 @@ Channel * channel_new(char *ctype, int type, int rfd, int wfd, int efd, u_int window, u_int maxpack, int extusage, char *remote_name, int nonblock) { - int i, found; + int found; + u_int i; Channel *c; /* Do initial allocation if this is the first call. */ @@ -222,10 +224,10 @@ channel_new(char *ctype, int type, int rfd, int wfd, int efd, for (found = -1, i = 0; i < channels_alloc; i++) if (channels[i] == NULL) { /* Found a free slot. */ - found = i; + found = (int)i; break; } - if (found == -1) { + if (found < 0) { /* There are no free slots. Take last+1 slot and expand the array. */ found = channels_alloc; if (channels_alloc > 10000) @@ -263,6 +265,7 @@ channel_new(char *ctype, int type, int rfd, int wfd, int efd, c->single_connection = 0; c->detach_user = NULL; c->confirm = NULL; + c->confirm_ctx = NULL; c->input_filter = NULL; debug("channel %d: new [%s]", found, remote_name); return c; @@ -271,7 +274,8 @@ channel_new(char *ctype, int type, int rfd, int wfd, int efd, static int channel_find_maxfd(void) { - int i, max = 0; + u_int i; + int max = 0; Channel *c; for (i = 0; i < channels_alloc; i++) { @@ -304,10 +308,11 @@ channel_close_fd(int *fdp) static void channel_close_fds(Channel *c) { - debug3("channel %d: close_fds r %d w %d e %d", - c->self, c->rfd, c->wfd, c->efd); + debug3("channel %d: close_fds r %d w %d e %d c %d", + c->self, c->rfd, c->wfd, c->efd, c->ctl_fd); channel_close_fd(&c->sock); + channel_close_fd(&c->ctl_fd); channel_close_fd(&c->rfd); channel_close_fd(&c->wfd); channel_close_fd(&c->efd); @@ -319,12 +324,12 @@ void channel_free(Channel *c) { char *s; - int i, n; + u_int i, n; for (n = 0, i = 0; i < channels_alloc; i++) if (channels[i]) n++; - debug("channel %d: free: %s, nchannels %d", c->self, + debug("channel %d: free: %s, nchannels %u", c->self, c->remote_name ? c->remote_name : "???", n); s = channel_open_message(); @@ -333,6 +338,8 @@ channel_free(Channel *c) if (c->sock != -1) shutdown(c->sock, SHUT_RDWR); + if (c->ctl_fd != -1) + shutdown(c->ctl_fd, SHUT_RDWR); channel_close_fds(c); buffer_free(&c->input); buffer_free(&c->output); @@ -348,7 +355,7 @@ channel_free(Channel *c) void channel_free_all(void) { - int i; + u_int i; for (i = 0; i < channels_alloc; i++) if (channels[i] != NULL) @@ -363,7 +370,7 @@ channel_free_all(void) void channel_close_all(void) { - int i; + u_int i; for (i = 0; i < channels_alloc; i++) if (channels[i] != NULL) @@ -377,7 +384,7 @@ channel_close_all(void) void channel_stop_listening(void) { - int i; + u_int i; Channel *c; for (i = 0; i < channels_alloc; i++) { @@ -434,7 +441,7 @@ channel_not_very_much_buffered_data(void) int channel_still_open(void) { - int i; + u_int i; Channel *c; for (i = 0; i < channels_alloc; i++) { @@ -477,12 +484,12 @@ channel_still_open(void) int channel_find_open(void) { - int i; + u_int i; Channel *c; for (i = 0; i < channels_alloc; i++) { c = channels[i]; - if (c == NULL) + if (c == NULL || c->remote_id < 0) continue; switch (c->type) { case SSH_CHANNEL_CLOSED: @@ -525,7 +532,7 @@ channel_open_message(void) Buffer buffer; Channel *c; char buf[1024], *cp; - int i; + u_int i; buffer_init(&buffer); snprintf(buf, sizeof buf, "The following connections are open:\r\n"); @@ -550,12 +557,13 @@ channel_open_message(void) case SSH_CHANNEL_X11_OPEN: case SSH_CHANNEL_INPUT_DRAINING: case SSH_CHANNEL_OUTPUT_DRAINING: - snprintf(buf, sizeof buf, " #%d %.300s (t%d r%d i%d/%d o%d/%d fd %d/%d)\r\n", + snprintf(buf, sizeof buf, + " #%d %.300s (t%d r%d i%d/%d o%d/%d fd %d/%d cfd %d)\r\n", c->self, c->remote_name, c->type, c->remote_id, c->istate, buffer_len(&c->input), c->ostate, buffer_len(&c->output), - c->rfd, c->wfd); + c->rfd, c->wfd, c->ctl_fd); buffer_append(&buffer, buf, strlen(buf)); continue; default: @@ -596,14 +604,14 @@ channel_request_start(int id, char *service, int wantconfirm) logit("channel_request_start: %d: unknown channel id", id); return; } - debug2("channel %d: request %s", id, service) ; + debug2("channel %d: request %s confirm %d", id, service, wantconfirm); packet_start(SSH2_MSG_CHANNEL_REQUEST); packet_put_int(c->remote_id); packet_put_cstring(service); packet_put_char(wantconfirm); } void -channel_register_confirm(int id, channel_callback_fn *fn) +channel_register_confirm(int id, channel_callback_fn *fn, void *ctx) { Channel *c = channel_lookup(id); @@ -612,6 +620,7 @@ channel_register_confirm(int id, channel_callback_fn *fn) return; } c->confirm = fn; + c->confirm_ctx = ctx; } void channel_register_cleanup(int id, channel_callback_fn *fn) @@ -729,6 +738,10 @@ channel_pre_open(Channel *c, fd_set * readset, fd_set * writeset) buffer_len(&c->extended) < c->remote_window) FD_SET(c->efd, readset); } + /* XXX: What about efd? races? */ + if (compat20 && c->ctl_fd != -1 && + c->istate == CHAN_INPUT_OPEN && c->ostate == CHAN_OUTPUT_OPEN) + FD_SET(c->ctl_fd, readset); } static void @@ -1031,7 +1044,7 @@ channel_decode_socks5(Channel *c, fd_set * readset, fd_set * writeset) buffer_get(&c->input, (char *)&dest_port, 2); dest_addr[addrlen] = '\0'; if (s5_req.atyp == SSH_SOCKS5_DOMAIN) - strlcpy(c->path, dest_addr, sizeof(c->path)); + strlcpy(c->path, (char *)dest_addr, sizeof(c->path)); else if (inet_ntop(af, dest_addr, c->path, sizeof(c->path)) == NULL) return -1; c->host_port = ntohs(dest_port); @@ -1482,6 +1495,33 @@ channel_handle_efd(Channel *c, fd_set * readset, fd_set * writeset) return 1; } static int +channel_handle_ctl(Channel *c, fd_set * readset, fd_set * writeset) +{ + char buf[16]; + int len; + + /* Monitor control fd to detect if the slave client exits */ + if (c->ctl_fd != -1 && FD_ISSET(c->ctl_fd, readset)) { + len = read(c->ctl_fd, buf, sizeof(buf)); + if (len < 0 && (errno == EINTR || errno == EAGAIN)) + return 1; + if (len <= 0) { + debug2("channel %d: ctl read<=0", c->self); + if (c->type != SSH_CHANNEL_OPEN) { + debug2("channel %d: not open", c->self); + chan_mark_dead(c); + return -1; + } else { + chan_read_failed(c); + chan_write_failed(c); + } + return -1; + } else + fatal("%s: unexpected data on ctl fd", __func__); + } + return 1; +} +static int channel_check_window(Channel *c) { if (c->type == SSH_CHANNEL_OPEN && @@ -1511,6 +1551,7 @@ channel_post_open(Channel *c, fd_set * readset, fd_set * writeset) if (!compat20) return; channel_handle_efd(c, readset, writeset); + channel_handle_ctl(c, readset, writeset); channel_check_window(c); } @@ -1635,7 +1676,7 @@ static void channel_handler(chan_fn *ftab[], fd_set * readset, fd_set * writeset) { static int did_init = 0; - int i; + u_int i; Channel *c; if (!did_init) { @@ -1658,10 +1699,9 @@ channel_handler(chan_fn *ftab[], fd_set * readset, fd_set * writeset) */ void channel_prepare_select(fd_set **readsetp, fd_set **writesetp, int *maxfdp, - int *nallocp, int rekeying) + u_int *nallocp, int rekeying) { - int n; - u_int sz; + u_int n, sz; n = MAX(*maxfdp, channel_max_fd); @@ -1697,8 +1737,7 @@ void channel_output_poll(void) { Channel *c; - int i; - u_int len; + u_int i, len; for (i = 0; i < channels_alloc; i++) { c = channels[i]; @@ -2011,7 +2050,7 @@ channel_input_open_confirmation(int type, u_int32_t seq, void *ctxt) c->remote_maxpacket = packet_get_int(); if (c->confirm) { debug2("callback start"); - c->confirm(c->self, NULL); + c->confirm(c->self, c->confirm_ctx); debug2("callback done"); } debug2("channel %d: open confirm rwindow %u rmax %u", c->self, @@ -2228,6 +2267,27 @@ channel_setup_fwd_listener(int type, const char *listen_addr, u_short listen_por return success; } +int +channel_cancel_rport_listener(const char *host, u_short port) +{ + u_int i; + int found = 0; + + for(i = 0; i < channels_alloc; i++) { + Channel *c = channels[i]; + + if (c != NULL && c->type == SSH_CHANNEL_RPORT_LISTENER && + strncmp(c->path, host, sizeof(c->path)) == 0 && + c->listening_port == port) { + debug2("%s: close clannel %d", __func__, i); + channel_free(c); + found = 1; + } + } + + return (found); +} + /* protocol local port fwd, used by ssh (and sshd in v1) */ int channel_setup_local_fwd_listener(u_short listen_port, @@ -2305,6 +2365,41 @@ channel_request_remote_forwarding(u_short listen_port, } /* + * Request cancellation of remote forwarding of connection host:port from + * local side. + */ +void +channel_request_rforward_cancel(u_short port) +{ + int i; + const char *address_to_bind = "0.0.0.0"; + + if (!compat20) + return; + + for (i = 0; i < num_permitted_opens; i++) { + if (permitted_opens[i].host_to_connect != NULL && + permitted_opens[i].listen_port == port) + break; + } + if (i >= num_permitted_opens) { + debug("%s: requested forward not found", __func__); + return; + } + packet_start(SSH2_MSG_GLOBAL_REQUEST); + packet_put_cstring("cancel-tcpip-forward"); + packet_put_char(0); + packet_put_cstring(address_to_bind); + packet_put_int(port); + packet_send(); + + permitted_opens[i].listen_port = 0; + permitted_opens[i].port_to_connect = 0; + free(permitted_opens[i].host_to_connect); + permitted_opens[i].host_to_connect = NULL; +} + +/* * This is called after receiving CHANNEL_FORWARDING_REQUEST. This initates * listening for the port, and sends back a success reply (or disconnect * message if there was an error). This never returns if there was an error. @@ -2373,7 +2468,8 @@ channel_clear_permitted_opens(void) int i; for (i = 0; i < num_permitted_opens; i++) - xfree(permitted_opens[i].host_to_connect); + if (permitted_opens[i].host_to_connect != NULL) + xfree(permitted_opens[i].host_to_connect); num_permitted_opens = 0; } @@ -2413,8 +2509,8 @@ connect_to(const char *host, u_short port) verbose("socket: %.100s", strerror(errno)); continue; } - if (fcntl(sock, F_SETFL, O_NONBLOCK) < 0) - fatal("connect_to: F_SETFL: %s", strerror(errno)); + if (set_nonblock(sock) == -1) + fatal("%s: set_nonblock(%d)", __func__, sock); if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0 && errno != EINPROGRESS) { error("connect_to %.100s port %s: %.100s", ntop, strport, @@ -2441,7 +2537,8 @@ channel_connect_by_listen_address(u_short listen_port) int i; for (i = 0; i < num_permitted_opens; i++) - if (permitted_opens[i].listen_port == listen_port) + if (permitted_opens[i].host_to_connect != NULL && + permitted_opens[i].listen_port == listen_port) return connect_to( permitted_opens[i].host_to_connect, permitted_opens[i].port_to_connect); @@ -2459,7 +2556,8 @@ channel_connect_to(const char *host, u_short port) permit = all_opens_permitted; if (!permit) { for (i = 0; i < num_permitted_opens; i++) - if (permitted_opens[i].port_to_connect == port && + if (permitted_opens[i].host_to_connect != NULL && + permitted_opens[i].port_to_connect == port && strcmp(permitted_opens[i].host_to_connect, host) == 0) permit = 1; @@ -2472,6 +2570,27 @@ channel_connect_to(const char *host, u_short port) return connect_to(host, port); } +void +channel_send_window_changes(void) +{ + u_int i; + struct winsize ws; + + for (i = 0; i < channels_alloc; i++) { + if (channels[i] == NULL || + channels[i]->type != SSH_CHANNEL_OPEN) + continue; + if (ioctl(channels[i]->rfd, TIOCGWINSZ, &ws) < 0) + continue; + channel_request_start(i, "window-change", 0); + packet_put_int(ws.ws_col); + packet_put_int(ws.ws_row); + packet_put_int(ws.ws_xpixel); + packet_put_int(ws.ws_ypixel); + packet_send(); + } +} + /* -- X11 forwarding */ /* @@ -2511,6 +2630,7 @@ x11_create_display_inet(int x11_display_offset, int x11_use_localhost, if (sock < 0) { if ((errno != EINVAL) && (errno != EAFNOSUPPORT)) { error("socket: %.100s", strerror(errno)); + freeaddrinfo(aitop); return -1; } else { debug("x11_create_display_inet: Socket family %d not supported", @@ -2783,7 +2903,7 @@ x11_request_forwarding_with_spoofing(int client_session_id, char *new_data; int screen_number; const char *cp; - u_int32_t rand = 0; + u_int32_t rnd = 0; cp = getenv("DISPLAY"); if (cp) @@ -2808,10 +2928,10 @@ x11_request_forwarding_with_spoofing(int client_session_id, if (sscanf(data + 2 * i, "%2x", &value) != 1) fatal("x11_request_forwarding: bad authentication data: %.100s", data); if (i % 4 == 0) - rand = arc4random(); + rnd = arc4random(); x11_saved_data[i] = value; - x11_fake_data[i] = rand & 0xff; - rand >>= 8; + x11_fake_data[i] = rnd & 0xff; + rnd >>= 8; } x11_saved_data_len = data_len; x11_fake_data_len = data_len; diff --git a/crypto/openssh/channels.h b/crypto/openssh/channels.h index 7d98147..f8dc824 100644 --- a/crypto/openssh/channels.h +++ b/crypto/openssh/channels.h @@ -1,4 +1,4 @@ -/* $OpenBSD: channels.h,v 1.71 2003/09/23 20:41:11 markus Exp $ */ +/* $OpenBSD: channels.h,v 1.74 2004/08/11 21:43:04 avsm Exp $ */ /* * Author: Tatu Ylonen <ylo@cs.hut.fi> @@ -76,6 +76,7 @@ struct Channel { int wfd; /* write fd */ int efd; /* extended fd */ int sock; /* sock fd */ + int ctl_fd; /* control fd (client sharing) */ int isatty; /* rfd is a tty */ int wfd_isatty; /* wfd is a tty */ int force_drain; /* force close on iEOF */ @@ -105,6 +106,7 @@ struct Channel { /* callback */ channel_callback_fn *confirm; channel_callback_fn *detach_user; + void *confirm_ctx; /* filter */ channel_filter_fn *input_filter; @@ -161,10 +163,11 @@ void channel_stop_listening(void); void channel_send_open(int); void channel_request_start(int, char *, int); void channel_register_cleanup(int, channel_callback_fn *); -void channel_register_confirm(int, channel_callback_fn *); +void channel_register_confirm(int, channel_callback_fn *, void *); void channel_register_filter(int, channel_filter_fn *); void channel_cancel_cleanup(int); int channel_close_fd(int *); +void channel_send_window_changes(void); /* protocol handler */ @@ -181,7 +184,7 @@ void channel_input_window_adjust(int, u_int32_t, void *); /* file descriptor handling (read/write) */ -void channel_prepare_select(fd_set **, fd_set **, int *, int*, int); +void channel_prepare_select(fd_set **, fd_set **, int *, u_int*, int); void channel_after_select(fd_set *, fd_set *); void channel_output_poll(void); @@ -200,8 +203,10 @@ void channel_input_port_forward_request(int, int); int channel_connect_to(const char *, u_short); int channel_connect_by_listen_address(u_short); void channel_request_remote_forwarding(u_short, const char *, u_short); +void channel_request_rforward_cancel(u_short port); int channel_setup_local_fwd_listener(u_short, const char *, u_short, int); int channel_setup_remote_fwd_listener(const char *, u_short, int); +int channel_cancel_rport_listener(const char *, u_short); /* x11 forwarding */ diff --git a/crypto/openssh/cipher.c b/crypto/openssh/cipher.c index c13ff58..075a4c5 100644 --- a/crypto/openssh/cipher.c +++ b/crypto/openssh/cipher.c @@ -35,7 +35,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: cipher.c,v 1.68 2004/01/23 19:26:33 hshoexer Exp $"); +RCSID("$OpenBSD: cipher.c,v 1.71 2004/07/28 09:40:29 markus Exp $"); #include "xmalloc.h" #include "log.h" @@ -76,19 +76,19 @@ struct Cipher { u_int key_len; const EVP_CIPHER *(*evptype)(void); } ciphers[] = { - { "none", SSH_CIPHER_NONE, 8, 0, EVP_enc_null }, - { "des", SSH_CIPHER_DES, 8, 8, EVP_des_cbc }, - { "3des", SSH_CIPHER_3DES, 8, 16, evp_ssh1_3des }, - { "blowfish", SSH_CIPHER_BLOWFISH, 8, 32, evp_ssh1_bf }, - - { "3des-cbc", SSH_CIPHER_SSH2, 8, 24, EVP_des_ede3_cbc }, - { "blowfish-cbc", SSH_CIPHER_SSH2, 8, 16, EVP_bf_cbc }, - { "cast128-cbc", SSH_CIPHER_SSH2, 8, 16, EVP_cast5_cbc }, - { "arcfour", SSH_CIPHER_SSH2, 8, 16, EVP_rc4 }, + { "none", SSH_CIPHER_NONE, 8, 0, EVP_enc_null }, + { "des", SSH_CIPHER_DES, 8, 8, EVP_des_cbc }, + { "3des", SSH_CIPHER_3DES, 8, 16, evp_ssh1_3des }, + { "blowfish", SSH_CIPHER_BLOWFISH, 8, 32, evp_ssh1_bf }, + + { "3des-cbc", SSH_CIPHER_SSH2, 8, 24, EVP_des_ede3_cbc }, + { "blowfish-cbc", SSH_CIPHER_SSH2, 8, 16, EVP_bf_cbc }, + { "cast128-cbc", SSH_CIPHER_SSH2, 8, 16, EVP_cast5_cbc }, + { "arcfour", SSH_CIPHER_SSH2, 8, 16, EVP_rc4 }, #if OPENSSL_VERSION_NUMBER < 0x00907000L - { "aes128-cbc", SSH_CIPHER_SSH2, 16, 16, evp_rijndael }, - { "aes192-cbc", SSH_CIPHER_SSH2, 16, 24, evp_rijndael }, - { "aes256-cbc", SSH_CIPHER_SSH2, 16, 32, evp_rijndael }, + { "aes128-cbc", SSH_CIPHER_SSH2, 16, 16, evp_rijndael }, + { "aes192-cbc", SSH_CIPHER_SSH2, 16, 24, evp_rijndael }, + { "aes256-cbc", SSH_CIPHER_SSH2, 16, 32, evp_rijndael }, { "rijndael-cbc@lysator.liu.se", SSH_CIPHER_SSH2, 16, 32, evp_rijndael }, #else @@ -99,14 +99,14 @@ struct Cipher { SSH_CIPHER_SSH2, 16, 32, EVP_aes_256_cbc }, #endif #if OPENSSL_VERSION_NUMBER >= 0x00905000L - { "aes128-ctr", SSH_CIPHER_SSH2, 16, 16, evp_aes_128_ctr }, - { "aes192-ctr", SSH_CIPHER_SSH2, 16, 24, evp_aes_128_ctr }, - { "aes256-ctr", SSH_CIPHER_SSH2, 16, 32, evp_aes_128_ctr }, + { "aes128-ctr", SSH_CIPHER_SSH2, 16, 16, evp_aes_128_ctr }, + { "aes192-ctr", SSH_CIPHER_SSH2, 16, 24, evp_aes_128_ctr }, + { "aes256-ctr", SSH_CIPHER_SSH2, 16, 32, evp_aes_128_ctr }, #endif #if defined(EVP_CTRL_SET_ACSS_MODE) { "acss@openssh.org", SSH_CIPHER_SSH2, 16, 5, EVP_acss }, #endif - { NULL, SSH_CIPHER_ILLEGAL, 0, 0, NULL } + { NULL, SSH_CIPHER_INVALID, 0, 0, NULL } }; /*--*/ @@ -166,25 +166,25 @@ int ciphers_valid(const char *names) { Cipher *c; - char *ciphers, *cp; + char *cipher_list, *cp; char *p; if (names == NULL || strcmp(names, "") == 0) return 0; - ciphers = cp = xstrdup(names); + cipher_list = cp = xstrdup(names); for ((p = strsep(&cp, CIPHER_SEP)); p && *p != '\0'; (p = strsep(&cp, CIPHER_SEP))) { c = cipher_by_name(p); if (c == NULL || c->number != SSH_CIPHER_SSH2) { debug("bad cipher %s [%s]", p, names); - xfree(ciphers); + xfree(cipher_list); return 0; } else { debug3("cipher ok: %s [%s]", p, names); } } debug3("ciphers ok: [%s]", names); - xfree(ciphers); + xfree(cipher_list); return 1; } @@ -213,7 +213,7 @@ cipher_name(int id) void cipher_init(CipherContext *cc, Cipher *cipher, const u_char *key, u_int keylen, const u_char *iv, u_int ivlen, - int encrypt) + int do_encrypt) { static int dowarn = 1; #ifdef SSH_OLD_EVP @@ -252,10 +252,10 @@ cipher_init(CipherContext *cc, Cipher *cipher, type->key_len = keylen; } EVP_CipherInit(&cc->evp, type, (u_char *)key, (u_char *)iv, - (encrypt == CIPHER_ENCRYPT)); + (do_encrypt == CIPHER_ENCRYPT)); #else if (EVP_CipherInit(&cc->evp, type, NULL, (u_char *)iv, - (encrypt == CIPHER_ENCRYPT)) == 0) + (do_encrypt == CIPHER_ENCRYPT)) == 0) fatal("cipher_init: EVP_CipherInit failed for %s", cipher->name); klen = EVP_CIPHER_CTX_key_length(&cc->evp); @@ -302,7 +302,7 @@ cipher_cleanup(CipherContext *cc) void cipher_set_key_string(CipherContext *cc, Cipher *cipher, - const char *passphrase, int encrypt) + const char *passphrase, int do_encrypt) { MD5_CTX md; u_char digest[16]; @@ -311,7 +311,7 @@ cipher_set_key_string(CipherContext *cc, Cipher *cipher, MD5_Update(&md, (const u_char *)passphrase, strlen(passphrase)); MD5_Final(digest, &md); - cipher_init(cc, cipher, digest, 16, NULL, 0, encrypt); + cipher_init(cc, cipher, digest, 16, NULL, 0, do_encrypt); memset(digest, 0, sizeof(digest)); memset(&md, 0, sizeof(md)); diff --git a/crypto/openssh/cipher.h b/crypto/openssh/cipher.h index 74b3669..6bb5719 100644 --- a/crypto/openssh/cipher.h +++ b/crypto/openssh/cipher.h @@ -1,4 +1,4 @@ -/* $OpenBSD: cipher.h,v 1.34 2003/11/10 16:23:41 jakob Exp $ */ +/* $OpenBSD: cipher.h,v 1.35 2004/07/28 09:40:29 markus Exp $ */ /* * Author: Tatu Ylonen <ylo@cs.hut.fi> @@ -43,7 +43,7 @@ * be removed for compatibility. The maximum allowed value is 31. */ #define SSH_CIPHER_SSH2 -3 -#define SSH_CIPHER_ILLEGAL -2 /* No valid cipher selected. */ +#define SSH_CIPHER_INVALID -2 /* No valid cipher selected. */ #define SSH_CIPHER_NOT_SET -1 /* None selected (invalid number). */ #define SSH_CIPHER_NONE 0 /* no encryption */ #define SSH_CIPHER_IDEA 1 /* IDEA CFB */ diff --git a/crypto/openssh/compat.h b/crypto/openssh/compat.h index efa0f08..5efb5c2 100644 --- a/crypto/openssh/compat.h +++ b/crypto/openssh/compat.h @@ -1,4 +1,4 @@ -/* $OpenBSD: compat.h,v 1.37 2003/11/02 11:01:03 markus Exp $ */ +/* $OpenBSD: compat.h,v 1.38 2004/07/11 17:48:47 deraadt Exp $ */ /* * Copyright (c) 1999, 2000, 2001 Markus Friedl. All rights reserved. @@ -27,7 +27,7 @@ #ifndef COMPAT_H #define COMPAT_H -#define SSH_PROTO_UNKNOWN 0x00 +#define SSH_PROTO_UNKNOWN 0x00 #define SSH_PROTO_1 0x01 #define SSH_PROTO_1_PREFERRED 0x02 #define SSH_PROTO_2 0x04 diff --git a/crypto/openssh/config.h b/crypto/openssh/config.h index ddf231e..e4cb781 100644 --- a/crypto/openssh/config.h +++ b/crypto/openssh/config.h @@ -1,6 +1,6 @@ /* config.h. Generated by configure. */ /* config.h.in. Generated from configure.ac by autoheader. */ -/* $Id: acconfig.h,v 1.177 2004/04/15 23:22:40 dtucker Exp $ */ +/* $Id: acconfig.h,v 1.180 2004/08/16 13:12:06 dtucker Exp $ */ /* $FreeBSD$ */ /* @@ -106,6 +106,9 @@ /* Work around problematic Linux PAM modules handling of PAM_TTY */ /* #undef PAM_TTY_KLUDGE */ +/* Define if pam_chauthtok wants real uid set to the unpriv'ed user */ +/* #undef SSHPAM_CHAUTHTOK_NEEDS_RUID */ + /* Use PIPES instead of a socketpair() */ /* #undef USE_PIPES */ @@ -439,6 +442,12 @@ /* Define if cmsg_type is not passed correctly */ /* #undef BROKEN_CMSG_TYPE */ +/* + * Define to whatever link() returns for "not supported" if it doesn't + * return EOPNOTSUPP. + */ +/* #undef LINK_OPNOTSUPP_ERRNO */ + /* Strings used in /etc/passwd to denote locked account */ /* #undef LOCKED_PASSWD_STRING */ /* #undef LOCKED_PASSWD_PREFIX */ @@ -453,6 +462,9 @@ /* Define if your resolver libs need this for getrrsetbyname */ /* #undef BIND_8_COMPAT */ +/* Define if you have /proc/$pid/fd */ +/* #undef HAVE_PROC_PID */ + /* Define to 1 if the `getpgrp' function requires zero arguments. */ #define GETPGRP_VOID 1 @@ -478,12 +490,25 @@ /* Define to 1 if you have the `clock' function. */ #define HAVE_CLOCK 1 +/* Define to 1 if you have the `closefrom' function. */ +/* #undef HAVE_CLOSEFROM */ + /* Define if gai_strerror() returns const char * */ /* #undef HAVE_CONST_GAI_STRERROR_PROTO */ /* Define to 1 if you have the <crypt.h> header file. */ /* #undef HAVE_CRYPT_H */ +/* Define to 1 if you have the declaration of `h_errno', and to 0 if you + don't. */ +#define HAVE_DECL_H_ERRNO 1 + +/* Define to 1 if you have the <dirent.h> header file. */ +#define HAVE_DIRENT_H 1 + +/* Define to 1 if you have the `dirfd' function. */ +/* #undef HAVE_DIRFD */ + /* Define to 1 if you have the `dirname' function. */ #define HAVE_DIRNAME 1 @@ -685,6 +710,9 @@ /* Define to 1 if you have the `mmap' function. */ #define HAVE_MMAP 1 +/* Define to 1 if you have the <ndir.h> header file. */ +/* #undef HAVE_NDIR_H */ + /* Define to 1 if you have the <netdb.h> header file. */ #define HAVE_NETDB_H 1 @@ -898,9 +926,15 @@ /* Define to 1 if you have the <sys/cdefs.h> header file. */ #define HAVE_SYS_CDEFS_H 1 +/* Define to 1 if you have the <sys/dir.h> header file. */ +#define HAVE_SYS_DIR_H 1 + /* Define to 1 if you have the <sys/mman.h> header file. */ #define HAVE_SYS_MMAN_H 1 +/* Define to 1 if you have the <sys/ndir.h> header file. */ +/* #undef HAVE_SYS_NDIR_H */ + /* Define to 1 if you have the <sys/prctl.h> header file. */ /* #undef HAVE_SYS_PRCTL_H */ diff --git a/crypto/openssh/configure.ac b/crypto/openssh/configure.ac index 41fdc34..a1e5497 100644 --- a/crypto/openssh/configure.ac +++ b/crypto/openssh/configure.ac @@ -1,5 +1,5 @@ +# $Id: configure.ac,v 1.226 2004/08/16 13:12:06 dtucker Exp $ # $FreeBSD$ -# $Id: configure.ac,v 1.202 2004/02/24 05:47:04 tim Exp $ # # Copyright (c) 1999-2004 Damien Miller # @@ -29,6 +29,8 @@ AC_PROG_CPP AC_PROG_RANLIB AC_PROG_INSTALL AC_PATH_PROG(AR, ar) +AC_PATH_PROG(CAT, cat) +AC_PATH_PROG(KILL, kill) AC_PATH_PROGS(PERL, perl5 perl) AC_PATH_PROG(SED, sed) AC_SUBST(PERL) @@ -38,6 +40,14 @@ AC_PATH_PROG(TEST_MINUS_S_SH, bash) AC_PATH_PROG(TEST_MINUS_S_SH, ksh) AC_PATH_PROG(TEST_MINUS_S_SH, sh) AC_PATH_PROG(SH, sh) +AC_SUBST(TEST_SHELL,sh) + +dnl for buildpkg.sh +AC_PATH_PROG(PATH_GROUPADD_PROG, groupadd, groupadd, + [/usr/sbin${PATH_SEPARATOR}/etc]) +AC_PATH_PROG(PATH_USERADD_PROG, useradd, useradd, + [/usr/sbin${PATH_SEPARATOR}/etc]) +AC_CHECK_PROG(MAKE_PACKAGE_SUPPORTED, pkgmk, yes, no) # System features AC_SYS_LARGEFILE @@ -245,6 +255,7 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16)) AC_DEFINE(PAM_TTY_KLUDGE) AC_DEFINE(LOCKED_PASSWD_PREFIX, "!") AC_DEFINE(SPT_TYPE,SPT_REUSEARGV) + AC_DEFINE(LINK_OPNOTSUPP_ERRNO, EPERM) inet6_default_4in6=yes case `uname -r` in 1.*|2.0.*) @@ -288,6 +299,7 @@ mips-sony-bsd|mips-sony-newsos4) AC_DEFINE(LOGIN_NEEDS_UTMPX) AC_DEFINE(LOGIN_NEEDS_TERM) AC_DEFINE(PAM_TTY_KLUDGE) + AC_DEFINE(SSHPAM_CHAUTHTOK_NEEDS_RUID) AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*") # Pushing STREAMS modules will cause sshd to acquire a controlling tty. AC_DEFINE(SSHD_ACQUIRES_CTTY) @@ -367,6 +379,7 @@ mips-sony-bsd|mips-sony-newsos4) AC_CHECK_FUNCS(getluid setluid) MANTYPE=man do_sco3_extra_lib_check=yes + TEST_SHELL=ksh ;; *-*-sco3.2v5*) if test -z "$GCC"; then @@ -382,8 +395,10 @@ mips-sony-bsd|mips-sony-newsos4) AC_DEFINE(BROKEN_SETREUID) AC_DEFINE(BROKEN_SETREGID) AC_DEFINE(WITH_ABBREV_NO_TTY) + AC_DEFINE(BROKEN_UPDWTMPX) AC_CHECK_FUNCS(getluid setluid) MANTYPE=man + TEST_SHELL=ksh ;; *-*-unicosmk*) AC_DEFINE(NO_SSH_LASTLOG) @@ -504,16 +519,16 @@ int main(){exit(0);} ) # Checks for header files. -AC_CHECK_HEADERS(bstring.h crypt.h endian.h features.h floatingpoint.h \ - getopt.h glob.h ia.h lastlog.h limits.h login.h \ - login_cap.h maillock.h netdb.h netgroup.h \ +AC_CHECK_HEADERS(bstring.h crypt.h dirent.h endian.h features.h \ + floatingpoint.h getopt.h glob.h ia.h lastlog.h limits.h login.h \ + login_cap.h maillock.h ndir.h netdb.h netgroup.h \ netinet/in_systm.h pam/pam_appl.h paths.h pty.h readpassphrase.h \ rpc/types.h security/pam_appl.h shadow.h stddef.h stdint.h \ - strings.h sys/strtio.h sys/audit.h sys/bitypes.h sys/bsdtty.h \ - sys/cdefs.h sys/mman.h sys/prctl.h sys/pstat.h sys/ptms.h \ - sys/select.h sys/stat.h sys/stream.h sys/stropts.h \ - sys/sysmacros.h sys/time.h sys/timers.h sys/un.h time.h tmpdir.h \ - ttyent.h usersec.h util.h utime.h utmp.h utmpx.h vis.h) + strings.h sys/dir.h sys/strtio.h sys/audit.h sys/bitypes.h \ + sys/bsdtty.h sys/cdefs.h sys/mman.h sys/ndir.h sys/prctl.h \ + sys/pstat.h sys/ptms.h sys/select.h sys/stat.h sys/stream.h \ + sys/stropts.h sys/sysmacros.h sys/time.h sys/timers.h sys/un.h \ + time.h tmpdir.h ttyent.h usersec.h util.h utime.h utmp.h utmpx.h vis.h) # Checks for libraries. AC_CHECK_FUNC(yp_match, , AC_CHECK_LIB(nsl, yp_match)) @@ -718,6 +733,14 @@ int main(void){struct dirent d;exit(sizeof(d.d_name)<=sizeof(char));} ] ) +AC_MSG_CHECKING([for /proc/pid/fd directory]) +if test -d "/proc/$$/fd" ; then + AC_DEFINE(HAVE_PROC_PID) + AC_MSG_RESULT(yes) +else + AC_MSG_RESULT(no) +fi + # Check whether user wants S/Key support SKEY_MSG="no" AC_ARG_WITH(skey, @@ -854,9 +877,9 @@ AC_ARG_WITH(tcp-wrappers, dnl Checks for library functions. Please keep in alphabetical order AC_CHECK_FUNCS(\ - arc4random __b64_ntop b64_ntop __b64_pton b64_pton \ - bcopy bindresvport_sa clock fchmod fchown freeaddrinfo futimes \ - getaddrinfo getcwd getgrouplist getnameinfo getopt \ + arc4random __b64_ntop b64_ntop __b64_pton b64_pton bcopy \ + bindresvport_sa clock closefrom dirfd fchmod fchown freeaddrinfo \ + futimes getaddrinfo getcwd getgrouplist getnameinfo getopt \ getpeereid _getpty getrlimit getttyent glob inet_aton \ inet_ntoa inet_ntop innetgr login_getcapbool md5_crypt memmove \ mkdtemp mmap ngetaddrinfo nsleep ogetaddrinfo openlog_r openpty \ @@ -896,6 +919,8 @@ AC_CHECK_DECL(tcsendbreak, [#include <termios.h>] ) +AC_CHECK_DECLS(h_errno, , ,[#include <netdb.h>]) + AC_CHECK_FUNCS(setresuid, [ dnl Some platorms have setresuid that isn't implemented, test for this AC_MSG_CHECKING(if setresuid seems to work) @@ -960,6 +985,20 @@ int main(void){char b[5];snprintf(b,5,"123456789");exit(b[4]!='\0');} ) fi +# Check for missing getpeereid (or equiv) support +NO_PEERCHECK="" +if test "x$ac_cv_func_getpeereid" != "xyes" ; then + AC_MSG_CHECKING([whether system supports SO_PEERCRED getsockopt]) + AC_TRY_COMPILE( + [#include <sys/types.h> + #include <sys/socket.h>], + [int i = SO_PEERCRED;], + [AC_MSG_RESULT(yes)], + [AC_MSG_RESULT(no) + NO_PEERCHECK=1] + ) +fi + dnl see whether mkstemp() requires XXXXXX if test "x$ac_cv_func_mkdtemp" = "xyes" ; then AC_MSG_CHECKING([for (overly) strict mkstemp]) @@ -2194,6 +2233,25 @@ AC_SEARCH_LIBS(getrrsetbyname, resolv, # Needed by our getrrsetbyname() AC_SEARCH_LIBS(res_query, resolv) AC_SEARCH_LIBS(dn_expand, resolv) + AC_MSG_CHECKING(if res_query will link) + AC_TRY_LINK_FUNC(res_query, AC_MSG_RESULT(yes), + [AC_MSG_RESULT(no) + saved_LIBS="$LIBS" + LIBS="$LIBS -lresolv" + AC_MSG_CHECKING(for res_query in -lresolv) + AC_LINK_IFELSE([ +#include <resolv.h> +int main() +{ + res_query (0, 0, 0, 0, 0); + return 0; +} + ], + [LIBS="$LIBS -lresolv" + AC_MSG_RESULT(yes)], + [LIBS="$saved_LIBS" + AC_MSG_RESULT(no)]) + ]) AC_CHECK_FUNCS(_getshort _getlong) AC_CHECK_MEMBER(HEADER.ad, [AC_DEFINE(HAVE_HEADER_AD)],, @@ -2247,7 +2305,10 @@ AC_ARG_WITH(kerberos5, [ char *tmp = heimdal_version; ], [ AC_MSG_RESULT(yes) AC_DEFINE(HEIMDAL) - K5LIBS="-lkrb5 -ldes -lcom_err -lasn1 -lroken" + K5LIBS="-lkrb5 -ldes" + K5LIBS="$K5LIBS -lcom_err -lasn1" + AC_CHECK_LIB(roken, net_write, + [K5LIBS="$K5LIBS -lroken"]) ], [ AC_MSG_RESULT(no) K5LIBS="-lkrb5 -lk5crypto -lcom_err" @@ -2910,7 +2971,7 @@ if test "$ac_cv_lib_pam_pam_set_item" = yes ; then fi AC_EXEEXT -AC_CONFIG_FILES([Makefile openbsd-compat/Makefile scard/Makefile ssh_prng_cmds]) +AC_CONFIG_FILES([Makefile buildpkg.sh opensshd.init openbsd-compat/Makefile scard/Makefile ssh_prng_cmds]) AC_OUTPUT # Print summary of options @@ -2976,6 +3037,10 @@ echo " Libraries: ${LIBWRAP} ${LIBPAM} ${LIBS}" echo "" +if test "x$MAKE_PACKAGE_SUPPORTED" = "xyes" ; then + echo "SVR4 style packages are supported with \"make package\"\n" +fi + if test "x$PAM_MSG" = "xyes" ; then echo "PAM is enabled. You may need to install a PAM control file " echo "for sshd, otherwise password authentication may fail. " @@ -2992,3 +3057,13 @@ if test ! -z "$RAND_HELPER_CMDHASH" ; then echo "" fi +if test ! -z "$NO_PEERCHECK" ; then + echo "WARNING: the operating system that you are using does not " + echo "appear to support either the getpeereid() API nor the " + echo "SO_PEERCRED getsockopt() option. These facilities are used to " + echo "enforce security checks to prevent unauthorised connections to " + echo "ssh-agent. Their absence increases the risk that a malicious " + echo "user can connect to your agent. " + echo "" +fi + diff --git a/crypto/openssh/contrib/Makefile b/crypto/openssh/contrib/Makefile deleted file mode 100644 index 2cef46f..0000000 --- a/crypto/openssh/contrib/Makefile +++ /dev/null @@ -1,15 +0,0 @@ -all: - @echo "Valid targets: gnome-ssh-askpass1 gnome-ssh-askpass2" - -gnome-ssh-askpass1: gnome-ssh-askpass1.c - $(CC) `gnome-config --cflags gnome gnomeui` \ - gnome-ssh-askpass1.c -o gnome-ssh-askpass1 \ - `gnome-config --libs gnome gnomeui` - -gnome-ssh-askpass2: gnome-ssh-askpass2.c - $(CC) `pkg-config --cflags gtk+-2.0` \ - gnome-ssh-askpass2.c -o gnome-ssh-askpass2 \ - `pkg-config --libs gtk+-2.0` - -clean: - rm -f *.o gnome-ssh-askpass1 gnome-ssh-askpass2 gnome-ssh-askpass diff --git a/crypto/openssh/contrib/README b/crypto/openssh/contrib/README deleted file mode 100644 index 9de3d96..0000000 --- a/crypto/openssh/contrib/README +++ /dev/null @@ -1,60 +0,0 @@ -Other patches and addons for OpenSSH. Please send submissions to -djm@mindrot.org - -Externally maintained ---------------------- - -SSH Proxy Command -- connect.c - -Shun-ichi GOTO <gotoh@imasy.or.jp> has written a very useful ProxyCommand -which allows the use of outbound SSH from behind a SOCKS4, SOCKS5 or -https CONNECT style proxy server. His page for connect.c has extensive -documentation on its use as well as compiled versions for Win32. - -http://www.taiyo.co.jp/~gotoh/ssh/connect.html - - -X11 SSH Askpass: - -Jim Knoble <jmknoble@pobox.com> has written an excellent X11 -passphrase requester. This is highly recommended: - -http://www.ntrnet.net/~jmknoble/software/x11-ssh-askpass/index.html - - -In this directory ------------------ - -ssh-copy-id: - -Phil Hands' <phil@hands.com> shell script to automate the process of adding -your public key to a remote machine's ~/.ssh/authorized_keys file. - -gnome-ssh-askpass[12]: - -A GNOME and Gtk2 passphrase requesters. Use "make gnome-ssh-askpass1" or -"make gnome-ssh-askpass2" to build. - -sshd.pam.generic: - -A generic PAM config file which may be useful on your system. YMMV - -sshd.pam.freebsd: - -A PAM config file which works with FreeBSD's PAM port. Contributed by -Dominik Brettnacher <domi@saargate.de> - -mdoc2man.pl: - -Converts mdoc formated manpages into normal manpages. This can be used -on Solaris machines to provide manpages that are not preformated. -Contributed by Mark D. Roth <roth@feep.net> - -redhat: - -RPM spec file and scripts for building Redhat packages - -suse: - -RPM spec file and scripts for building SuSE packages - diff --git a/crypto/openssh/contrib/aix/README b/crypto/openssh/contrib/aix/README deleted file mode 100644 index 2a29935..0000000 --- a/crypto/openssh/contrib/aix/README +++ /dev/null @@ -1,50 +0,0 @@ -Overview: - -This directory contains files to build an AIX native (installp or SMIT -installable) openssh package. - - -Directions: - -(optional) create config.local in your build dir -./configure [options] -contrib/aix/buildbff.sh - -The file config.local or the environment is read to set the following options -(default first): -PERMIT_ROOT_LOGIN=[no|yes] -X11_FORWARDING=[no|yes] -AIX_SRC=[no|yes] - -Acknowledgements: - -The contents of this directory are based on Ben Lindstrom's Solaris -buildpkg.sh. Ben also supplied inventory.sh. - -Jim Abbey's (GPL'ed) lppbuild-2.1 was used to learn how to build .bff's -and for comparison with the output from this script, however no code -from lppbuild is included and it is not required for operation. - -SRC support based on examples provided by Sandor Sklar and Maarten Kreuger. -PrivSep account handling fixes contributed by W. Earl Allen. - - -Other notes: - -The script treats all packages as USR packages (not ROOT+USR when -appropriate). It seems to work, though...... - -If there are any patches to this that have not yet been integrated they -may be found at http://www.zip.com.au/~dtucker/openssh/. - - -Disclaimer: - -It is hoped that it is useful but there is no warranty. If it breaks -you get to keep both pieces. - - - - Darren Tucker (dtucker at zip dot com dot au) - 2002/03/01 - -$Id: README,v 1.4 2003/08/25 05:01:04 dtucker Exp $ diff --git a/crypto/openssh/contrib/aix/buildbff.sh b/crypto/openssh/contrib/aix/buildbff.sh deleted file mode 100755 index 4a5c32b0e..0000000 --- a/crypto/openssh/contrib/aix/buildbff.sh +++ /dev/null @@ -1,383 +0,0 @@ -#!/bin/sh -# -# buildbff.sh: Create AIX SMIT-installable OpenSSH packages -# $Id: buildbff.sh,v 1.7 2003/11/21 12:48:56 djm Exp $ -# -# Author: Darren Tucker (dtucker at zip dot com dot au) -# This file is placed in the public domain and comes with absolutely -# no warranty. -# -# Based originally on Ben Lindstrom's buildpkg.sh for Solaris -# - -# -# Tunable configuration settings -# create a "config.local" in your build directory or set -# environment variables to override these. -# -[ -z "$PERMIT_ROOT_LOGIN" ] && PERMIT_ROOT_LOGIN=no -[ -z "$X11_FORWARDING" ] && X11_FORWARDING=no -[ -z "$AIX_SRC" ] && AIX_SRC=no - -umask 022 - -startdir=`pwd` - -# Path to inventory.sh: same place as buildbff.sh -if echo $0 | egrep '^/' -then - inventory=`dirname $0`/inventory.sh # absolute path -else - inventory=`pwd`/`dirname $0`/inventory.sh # relative path -fi - -# -# We still support running from contrib/aix, but this is deprecated -# -if pwd | egrep 'contrib/aix$' -then - echo "Changing directory to `pwd`/../.." - echo "Please run buildbff.sh from your build directory in future." - cd ../.. - contribaix=1 -fi - -if [ ! -f Makefile ] -then - echo "Makefile not found (did you run configure?)" - exit 1 -fi - -# -# Directories used during build: -# current dir = $objdir directory you ran ./configure in. -# $objdir/$PKGDIR/ directory package files are constructed in -# $objdir/$PKGDIR/root/ package root ($FAKE_ROOT) -# -objdir=`pwd` -PKGNAME=openssh -PKGDIR=package - -# -# Collect local configuration settings to override defaults -# -if [ -s ./config.local ] -then - echo Reading local settings from config.local - . ./config.local -fi - -# -# Fill in some details from Makefile, like prefix and sysconfdir -# the eval also expands variables like sysconfdir=${prefix}/etc -# provided they are eval'ed in the correct order -# -for confvar in prefix exec_prefix bindir sbindir libexecdir datadir mandir mansubdir sysconfdir piddir srcdir -do - eval $confvar=`grep "^$confvar=" $objdir/Makefile | cut -d = -f 2` -done - -# -# Collect values of privsep user and privsep path -# currently only found in config.h -# -for confvar in SSH_PRIVSEP_USER PRIVSEP_PATH -do - eval $confvar=`awk '/#define[ \t]'$confvar'/{print $3}' $objdir/config.h` -done - -# Set privsep defaults if not defined -if [ -z "$SSH_PRIVSEP_USER" ] -then - SSH_PRIVSEP_USER=sshd -fi -if [ -z "$PRIVSEP_PATH" ] -then - PRIVSEP_PATH=/var/empty -fi - -# Clean package build directory -rm -rf $objdir/$PKGDIR -FAKE_ROOT=$objdir/$PKGDIR/root -mkdir -p $FAKE_ROOT - -# Start by faking root install -echo "Faking root install..." -cd $objdir -make install-nokeys DESTDIR=$FAKE_ROOT - -if [ $? -gt 0 ] -then - echo "Fake root install failed, stopping." - exit 1 -fi - -# -# Copy informational files to include in package -# -cp $srcdir/LICENCE $objdir/$PKGDIR/ -cp $srcdir/README* $objdir/$PKGDIR/ - -# -# Extract common info requires for the 'info' part of the package. -# AIX requires 4-part version numbers -# -VERSION=`./ssh -V 2>&1 | cut -f 1 -d , | cut -f 2 -d _` -MAJOR=`echo $VERSION | cut -f 1 -d p | cut -f 1 -d .` -MINOR=`echo $VERSION | cut -f 1 -d p | cut -f 2 -d .` -PATCH=`echo $VERSION | cut -f 1 -d p | cut -f 3 -d .` -PORTABLE=`echo $VERSION | awk 'BEGIN{FS="p"}{print $2}'` -[ "$PATCH" = "" ] && PATCH=0 -[ "$PORTABLE" = "" ] && PORTABLE=0 -BFFVERSION=`printf "%d.%d.%d.%d" $MAJOR $MINOR $PATCH $PORTABLE` - -echo "Building BFF for $PKGNAME $VERSION (package version $BFFVERSION)" - -# -# Set ssh and sshd parameters as per config.local -# -if [ "${PERMIT_ROOT_LOGIN}" = no ] -then - perl -p -i -e "s/#PermitRootLogin yes/PermitRootLogin no/" \ - $FAKE_ROOT/${sysconfdir}/sshd_config -fi -if [ "${X11_FORWARDING}" = yes ] -then - perl -p -i -e "s/#X11Forwarding no/X11Forwarding yes/" \ - $FAKE_ROOT/${sysconfdir}/sshd_config -fi - - -# Rename config files; postinstall script will copy them if necessary -for cfgfile in ssh_config sshd_config ssh_prng_cmds -do - mv $FAKE_ROOT/$sysconfdir/$cfgfile $FAKE_ROOT/$sysconfdir/$cfgfile.default -done - -# -# Generate lpp control files. -# working dir is $FAKE_ROOT but files are generated in dir above -# and moved into place just before creation of .bff -# -cd $FAKE_ROOT -echo Generating LPP control files -find . ! -name . -print >../openssh.al -$inventory >../openssh.inventory - -cat <<EOD >../openssh.copyright -This software is distributed under a BSD-style license. -For the full text of the license, see /usr/lpp/openssh/LICENCE -EOD - -# -# openssh.size file allows filesystem expansion as required -# generate list of directories containing files -# then calculate disk usage for each directory and store in openssh.size -# -files=`find . -type f -print` -dirs=`for file in $files; do dirname $file; done | sort -u` -for dir in $dirs -do - du $dir -done > ../openssh.size - -# -# Create postinstall script -# -cat <<EOF >>../openssh.post_i -#!/bin/sh - -echo Creating configs from defaults if necessary. -for cfgfile in ssh_config sshd_config ssh_prng_cmds -do - if [ ! -f $sysconfdir/\$cfgfile ] - then - echo "Creating \$cfgfile from default" - cp $sysconfdir/\$cfgfile.default $sysconfdir/\$cfgfile - else - echo "\$cfgfile already exists." - fi -done -echo - -# Create PrivSep user if PrivSep not disabled in config -echo Creating PrivSep prereqs if required. -if egrep '^[ \t]*UsePrivilegeSeparation[ \t]+no' $sysconfdir/sshd_config >/dev/null -then - echo "UsePrivilegeSeparation disabled in config, not creating PrivSep user," - echo "group or chroot directory." -else - echo "UsePrivilegeSeparation enabled in config (or defaulting to on)." - - # create group if required - if cut -f1 -d: /etc/group | egrep '^'$SSH_PRIVSEP_USER'\$' >/dev/null - then - echo "PrivSep group $SSH_PRIVSEP_USER already exists." - else - echo "Creating PrivSep group $SSH_PRIVSEP_USER." - mkgroup -A $SSH_PRIVSEP_USER - fi - - # Create user if required - if lsuser ALL | cut -f1 -d: | egrep '^'$SSH_PRIVSEP_USER'\$' >/dev/null - then - echo "PrivSep user $SSH_PRIVSEP_USER already exists." - else - echo "Creating PrivSep user $SSH_PRIVSEP_USER." - mkuser gecos='SSHD PrivSep User' login=false rlogin=false account_locked=true pgrp=$SSH_PRIVSEP_USER $SSH_PRIVSEP_USER - fi - - # create chroot directory if required - if [ -d $PRIVSEP_PATH ] - then - echo "PrivSep chroot directory $PRIVSEP_PATH already exists." - else - echo "Creating PrivSep chroot directory $PRIVSEP_PATH." - mkdir $PRIVSEP_PATH - chown 0 $PRIVSEP_PATH - chgrp 0 $PRIVSEP_PATH - chmod 755 $PRIVSEP_PATH - fi -fi -echo - -# Generate keys unless they already exist -echo Creating host keys if required. -if [ -f "$sysconfdir/ssh_host_key" ] ; then - echo "$sysconfdir/ssh_host_key already exists, skipping." -else - $bindir/ssh-keygen -t rsa1 -f $sysconfdir/ssh_host_key -N "" -fi -if [ -f $sysconfdir/ssh_host_dsa_key ] ; then - echo "$sysconfdir/ssh_host_dsa_key already exists, skipping." -else - $bindir/ssh-keygen -t dsa -f $sysconfdir/ssh_host_dsa_key -N "" -fi -if [ -f $sysconfdir/ssh_host_rsa_key ] ; then - echo "$sysconfdir/ssh_host_rsa_key already exists, skipping." -else - $bindir/ssh-keygen -t rsa -f $sysconfdir/ssh_host_rsa_key -N "" -fi -echo - -# Set startup command depending on SRC support -if [ "$AIX_SRC" = "yes" ] -then - echo Creating SRC sshd subsystem. - rmssys -s sshd 2>&1 >/dev/null - mkssys -s sshd -p "$sbindir/sshd" -a '-D' -u 0 -S -n 15 -f 9 -R -G tcpip - startupcmd="start $sbindir/sshd \\\"\\\$src_running\\\"" - oldstartcmd="$sbindir/sshd" -else - startupcmd="$sbindir/sshd" - oldstartcmd="start $sbindir/sshd \\\"$src_running\\\"" -fi - -# If migrating to or from SRC, change previous startup command -# otherwise add to rc.tcpip -if egrep "^\$oldstartcmd" /etc/rc.tcpip >/dev/null -then - if sed "s|^\$oldstartcmd|\$startupcmd|g" /etc/rc.tcpip >/etc/rc.tcpip.new - then - chmod 0755 /etc/rc.tcpip.new - mv /etc/rc.tcpip /etc/rc.tcpip.old && \ - mv /etc/rc.tcpip.new /etc/rc.tcpip - else - echo "Updating /etc/rc.tcpip failed, please check." - fi -else - # Add to system startup if required - if grep "^\$startupcmd" /etc/rc.tcpip >/dev/null - then - echo "sshd found in rc.tcpip, not adding." - else - echo "Adding sshd to rc.tcpip" - echo >>/etc/rc.tcpip - echo "# Start sshd" >>/etc/rc.tcpip - echo "\$startupcmd" >>/etc/rc.tcpip - fi -fi -EOF - -# -# Create liblpp.a and move control files into it -# -echo Creating liblpp.a -( - cd .. - for i in openssh.al openssh.copyright openssh.inventory openssh.post_i openssh.size LICENCE README* - do - ar -r liblpp.a $i - rm $i - done -) - -# -# Create lpp_name -# -# This will end up looking something like: -# 4 R I OpenSSH { -# OpenSSH 3.0.2.1 1 N U en_US OpenSSH 3.0.2p1 Portable for AIX -# [ -# % -# /usr/local/bin 8073 -# /usr/local/etc 189 -# /usr/local/libexec 185 -# /usr/local/man/man1 145 -# /usr/local/man/man8 83 -# /usr/local/sbin 2105 -# /usr/local/share 3 -# % -# ] -# } - -echo Creating lpp_name -cat <<EOF >../lpp_name -4 R I $PKGNAME { -$PKGNAME $BFFVERSION 1 N U en_US OpenSSH $VERSION Portable for AIX -[ -% -EOF - -for i in $bindir $sysconfdir $libexecdir $mandir/${mansubdir}1 $mandir/${mansubdir}8 $sbindir $datadir /usr/lpp/openssh -do - # get size in 512 byte blocks - if [ -d $FAKE_ROOT/$i ] - then - size=`du $FAKE_ROOT/$i | awk '{print $1}'` - echo "$i $size" >>../lpp_name - fi -done - -echo '%' >>../lpp_name -echo ']' >>../lpp_name -echo '}' >>../lpp_name - -# -# Move pieces into place -# -mkdir -p usr/lpp/openssh -mv ../liblpp.a usr/lpp/openssh -mv ../lpp_name . - -# -# Now invoke backup to create .bff file -# note: lpp_name needs to be the first file so we generate the -# file list on the fly and feed it to backup using -i -# -echo Creating $PKGNAME-$VERSION.bff with backup... -rm -f $PKGNAME-$VERSION.bff -( - echo "./lpp_name" - find . ! -name lpp_name -a ! -name . -print -) | backup -i -q -f ../$PKGNAME-$VERSION.bff $filelist - -# -# Move package into final location and clean up -# -mv ../$PKGNAME-$VERSION.bff $startdir -cd $startdir -rm -rf $objdir/$PKGDIR - -echo $0: done. - diff --git a/crypto/openssh/contrib/aix/inventory.sh b/crypto/openssh/contrib/aix/inventory.sh deleted file mode 100755 index e2641e7..0000000 --- a/crypto/openssh/contrib/aix/inventory.sh +++ /dev/null @@ -1,63 +0,0 @@ -#!/bin/sh -# -# inventory.sh -# $Id: inventory.sh,v 1.6 2003/11/21 12:48:56 djm Exp $ -# -# Originally written by Ben Lindstrom, modified by Darren Tucker to use perl -# This file is placed into the public domain. -# -# This will produce an AIX package inventory file, which looks like: -# -# /usr/local/bin: -# class=apply,inventory,openssh -# owner=root -# group=system -# mode=755 -# type=DIRECTORY -# /usr/local/bin/slogin: -# class=apply,inventory,openssh -# owner=root -# group=system -# mode=777 -# type=SYMLINK -# target=ssh -# /usr/local/share/Ssh.bin: -# class=apply,inventory,openssh -# owner=root -# group=system -# mode=644 -# type=FILE -# size=VOLATILE -# checksum=VOLATILE - -find . ! -name . -print | perl -ne '{ - chomp; - if ( -l $_ ) { - ($dev,$ino,$mod,$nl,$uid,$gid,$rdev,$sz,$at,$mt,$ct,$bsz,$blk)=lstat; - } else { - ($dev,$ino,$mod,$nl,$uid,$gid,$rdev,$sz,$at,$mt,$ct,$bsz,$blk)=stat; - } - - # Start to display inventory information - $name = $_; - $name =~ s|^.||; # Strip leading dot from path - print "$name:\n"; - print "\tclass=apply,inventory,openssh\n"; - print "\towner=root\n"; - print "\tgroup=system\n"; - printf "\tmode=%lo\n", $mod & 07777; # Mask perm bits - - if ( -l $_ ) { - # Entry is SymLink - print "\ttype=SYMLINK\n"; - printf "\ttarget=%s\n", readlink($_); - } elsif ( -f $_ ) { - # Entry is File - print "\ttype=FILE\n"; - print "\tsize=$sz\n"; - print "\tchecksum=VOLATILE\n"; - } elsif ( -d $_ ) { - # Entry is Directory - print "\ttype=DIRECTORY\n"; - } -}' diff --git a/crypto/openssh/contrib/aix/pam.conf b/crypto/openssh/contrib/aix/pam.conf deleted file mode 100644 index 1495f43..0000000 --- a/crypto/openssh/contrib/aix/pam.conf +++ /dev/null @@ -1,20 +0,0 @@ -# -# PAM configuration file /etc/pam.conf -# Example for OpenSSH on AIX 5.2 -# - -# Authentication Management -sshd auth required /usr/lib/security/pam_aix -OTHER auth required /usr/lib/security/pam_aix - -# Account Management -sshd account required /usr/lib/security/pam_aix -OTHER account required /usr/lib/security/pam_aix - -# Session Management -sshd password required /usr/lib/security/pam_aix -OTHER password required /usr/lib/security/pam_aix - -# Password Management -sshd session required /usr/lib/security/pam_aix -OTHER session required /usr/lib/security/pam_aix diff --git a/crypto/openssh/contrib/caldera/openssh.spec b/crypto/openssh/contrib/caldera/openssh.spec deleted file mode 100644 index e690f10..0000000 --- a/crypto/openssh/contrib/caldera/openssh.spec +++ /dev/null @@ -1,366 +0,0 @@ - -# Some of this will need re-evaluation post-LSB. The SVIdir is there -# because the link appeared broken. The rest is for easy compilation, -# the tradeoff open to discussion. (LC957) - -%define SVIdir /etc/rc.d/init.d -%{!?_defaultdocdir:%define _defaultdocdir %{_prefix}/share/doc/packages} -%{!?SVIcdir:%define SVIcdir /etc/sysconfig/daemons} - -%define _mandir %{_prefix}/share/man/en -%define _sysconfdir /etc/ssh -%define _libexecdir %{_libdir}/ssh - -# Do we want to disable root_login? (1=yes 0=no) -%define no_root_login 0 - -#old cvs stuff. please update before use. may be deprecated. -%define use_stable 1 -%if %{use_stable} - %define version 3.8.1p1 - %define cvs %{nil} - %define release 1 -%else - %define version 3.8.1p1 - %define cvs cvs20011009 - %define release 0r1 -%endif -%define xsa x11-ssh-askpass -%define askpass %{xsa}-1.2.4.1 - -# OpenSSH privilege separation requires a user & group ID -%define sshd_uid 67 -%define sshd_gid 67 - -Name : openssh -Version : %{version}%{cvs} -Release : %{release} -Group : System/Network - -Summary : OpenSSH free Secure Shell (SSH) implementation. -Summary(de) : OpenSSH - freie Implementation der Secure Shell (SSH). -Summary(es) : OpenSSH implementación libre de Secure Shell (SSH). -Summary(fr) : Implémentation libre du shell sécurisé OpenSSH (SSH). -Summary(it) : Implementazione gratuita OpenSSH della Secure Shell. -Summary(pt) : Implementação livre OpenSSH do protocolo 'Secure Shell' (SSH). -Summary(pt_BR) : Implementação livre OpenSSH do protocolo Secure Shell (SSH). - -Copyright : BSD -Packager : Raymund Will <ray@caldera.de> -URL : http://www.openssh.com/ - -Obsoletes : ssh, ssh-clients, openssh-clients - -BuildRoot : /tmp/%{name}-%{version} -BuildRequires : XFree86-imake - -# %{use_stable}==1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable -# %{use_stable}==0: :pserver:cvs@bass.directhit.com:/cvs/openssh_cvs -Source0: see-above:/.../openssh-%{version}.tar.gz -%if %{use_stable} -Source1: see-above:/.../openssh-%{version}.tar.gz.sig -%endif -Source2: http://www.ntrnet.net/~jmknoble/software/%{xsa}/%{askpass}.tar.gz -Source3: http://www.openssh.com/faq.html - -%Package server -Group : System/Network -Requires : openssh = %{version} -Obsoletes : ssh-server - -Summary : OpenSSH Secure Shell protocol server (sshd). -Summary(de) : OpenSSH Secure Shell Protocol-Server (sshd). -Summary(es) : Servidor del protocolo OpenSSH Secure Shell (sshd). -Summary(fr) : Serveur de protocole du shell sécurisé OpenSSH (sshd). -Summary(it) : Server OpenSSH per il protocollo Secure Shell (sshd). -Summary(pt) : Servidor do protocolo 'Secure Shell' OpenSSH (sshd). -Summary(pt_BR) : Servidor do protocolo Secure Shell OpenSSH (sshd). - - -%Package askpass -Group : System/Network -Requires : openssh = %{version} -URL : http://www.ntrnet.net/~jmknoble/software/x11-ssh-askpass/ -Obsoletes : ssh-extras - -Summary : OpenSSH X11 pass-phrase dialog. -Summary(de) : OpenSSH X11 Passwort-Dialog. -Summary(es) : Aplicación de petición de frase clave OpenSSH X11. -Summary(fr) : Dialogue pass-phrase X11 d'OpenSSH. -Summary(it) : Finestra di dialogo X11 per la frase segreta di OpenSSH. -Summary(pt) : Diálogo de pedido de senha para X11 do OpenSSH. -Summary(pt_BR) : Diálogo de pedido de senha para X11 do OpenSSH. - - -%Description -OpenSSH (Secure Shell) provides access to a remote system. It replaces -telnet, rlogin, rexec, and rsh, and provides secure encrypted -communications between two untrusted hosts over an insecure network. -X11 connections and arbitrary TCP/IP ports can also be forwarded over -the secure channel. - -%Description -l de -OpenSSH (Secure Shell) stellt den Zugang zu anderen Rechnern her. Es ersetzt -telnet, rlogin, rexec und rsh und stellt eine sichere, verschlüsselte -Verbindung zwischen zwei nicht vertrauenswürdigen Hosts über eine unsicheres -Netzwerk her. X11 Verbindungen und beliebige andere TCP/IP Ports können ebenso -über den sicheren Channel weitergeleitet werden. - -%Description -l es -OpenSSH (Secure Shell) proporciona acceso a sistemas remotos. Reemplaza a -telnet, rlogin, rexec, y rsh, y proporciona comunicaciones seguras encriptadas -entre dos equipos entre los que no se ha establecido confianza a través de una -red insegura. Las conexiones X11 y puertos TCP/IP arbitrarios también pueden -ser canalizadas sobre el canal seguro. - -%Description -l fr -OpenSSH (Secure Shell) fournit un accès à un système distant. Il remplace -telnet, rlogin, rexec et rsh, tout en assurant des communications cryptées -securisées entre deux hôtes non fiabilisés sur un réseau non sécurisé. Des -connexions X11 et des ports TCP/IP arbitraires peuvent également être -transmis sur le canal sécurisé. - -%Description -l it -OpenSSH (Secure Shell) fornisce l'accesso ad un sistema remoto. -Sostituisce telnet, rlogin, rexec, e rsh, e fornisce comunicazioni sicure -e crittate tra due host non fidati su una rete non sicura. Le connessioni -X11 ad una porta TCP/IP arbitraria possono essere inoltrate attraverso -un canale sicuro. - -%Description -l pt -OpenSSH (Secure Shell) fornece acesso a um sistema remoto. Substitui o -telnet, rlogin, rexec, e o rsh e fornece comunicações seguras e cifradas -entre duas máquinas sem confiança mútua sobre uma rede insegura. -Ligações X11 e portos TCP/IP arbitrários também poder ser reenviados -pelo canal seguro. - -%Description -l pt_BR -O OpenSSH (Secure Shell) fornece acesso a um sistema remoto. Substitui o -telnet, rlogin, rexec, e o rsh e fornece comunicações seguras e criptografadas -entre duas máquinas sem confiança mútua sobre uma rede insegura. -Ligações X11 e portas TCP/IP arbitrárias também podem ser reenviadas -pelo canal seguro. - -%Description server -This package installs the sshd, the server portion of OpenSSH. - -%Description -l de server -Dieses Paket installiert den sshd, den Server-Teil der OpenSSH. - -%Description -l es server -Este paquete instala sshd, la parte servidor de OpenSSH. - -%Description -l fr server -Ce paquetage installe le 'sshd', partie serveur de OpenSSH. - -%Description -l it server -Questo pacchetto installa sshd, il server di OpenSSH. - -%Description -l pt server -Este pacote intala o sshd, o servidor do OpenSSH. - -%Description -l pt_BR server -Este pacote intala o sshd, o servidor do OpenSSH. - -%Description askpass -This package contains an X11-based pass-phrase dialog used per -default by ssh-add(1). It is based on %{askpass} -by Jim Knoble <jmknoble@pobox.com>. - - -%Prep -%setup %([ -z "%{cvs}" ] || echo "-n %{name}_cvs") -a2 -%if ! %{use_stable} - autoreconf -%endif - - -%Build -CFLAGS="$RPM_OPT_FLAGS" \ -%configure \ - --with-pam \ - --with-tcp-wrappers \ - --with-privsep-path=%{_var}/empty/sshd \ - #leave this line for easy edits. - -%__make CFLAGS="$RPM_OPT_FLAGS" - -cd %{askpass} -%configure \ - #leave this line for easy edits. - -xmkmf -%__make includes -%__make - - -%Install -[ %{buildroot} != "/" ] && rm -rf %{buildroot} - -make install DESTDIR=%{buildroot} -%makeinstall -C %{askpass} \ - BINDIR=%{_libexecdir} \ - MANPATH=%{_mandir} \ - DESTDIR=%{buildroot} - -# OpenLinux specific configuration -mkdir -p %{buildroot}{/etc/pam.d,%{SVIcdir},%{SVIdir}} -mkdir -p %{buildroot}%{_var}/empty/sshd - -# enabling X11 forwarding on the server is convenient and okay, -# on the client side it's a potential security risk! -%__perl -pi -e 's:#X11Forwarding no:X11Forwarding yes:g' \ - %{buildroot}%{_sysconfdir}/sshd_config - -%if %{no_root_login} -%__perl -pi -e 's:#PermitRootLogin yes:PermitRootLogin no:g' \ - %{buildroot}%{_sysconfdir}/sshd_config -%endif - -install -m644 contrib/caldera/sshd.pam %{buildroot}/etc/pam.d/sshd -# FIXME: disabled, find out why this doesn't work with nis -%__perl -pi -e 's:(.*pam_limits.*):#$1:' \ - %{buildroot}/etc/pam.d/sshd - -install -m 0755 contrib/caldera/sshd.init %{buildroot}%{SVIdir}/sshd - -# the last one is needless, but more future-proof -find %{buildroot}%{SVIdir} -type f -exec \ - %__perl -pi -e 's:\@SVIdir\@:%{SVIdir}:g;\ - s:\@sysconfdir\@:%{_sysconfdir}:g; \ - s:/usr/sbin:%{_sbindir}:g'\ - \{\} \; - -cat <<-EoD > %{buildroot}%{SVIcdir}/sshd - IDENT=sshd - DESCRIPTIVE="OpenSSH secure shell daemon" - # This service will be marked as 'skipped' on boot if there - # is no host key. Use ssh-host-keygen to generate one - ONBOOT="yes" - OPTIONS="" -EoD - -SKG=%{buildroot}%{_sbindir}/ssh-host-keygen -install -m 0755 contrib/caldera/ssh-host-keygen $SKG -# Fix up some path names in the keygen toy^Hol - %__perl -pi -e 's:\@sysconfdir\@:%{_sysconfdir}:g; \ - s:\@sshkeygen\@:%{_bindir}/ssh-keygen:g' \ - %{buildroot}%{_sbindir}/ssh-host-keygen - -# This looks terrible. Expect it to change. -# install remaining docs -DocD="%{buildroot}%{_defaultdocdir}/%{name}-%{version}" -mkdir -p $DocD/%{askpass} -cp -a CREDITS ChangeLog LICENCE OVERVIEW README* TODO $DocD -install -p -m 0444 %{SOURCE3} $DocD/faq.html -cp -a %{askpass}/{README,ChangeLog,TODO,SshAskpass*.ad} $DocD/%{askpass} -%if %{use_stable} - cp -p %{askpass}/%{xsa}.man $DocD/%{askpass}/%{xsa}.1 -%else - cp -p %{askpass}/%{xsa}.man %{buildroot}%{_mandir}man1/%{xsa}.1 - ln -s %{xsa}.1 %{buildroot}%{_mandir}man1/ssh-askpass.1 -%endif - -find %{buildroot}%{_mandir} -type f -not -name '*.gz' -print0 | xargs -0r %__gzip -9nf -rm %{buildroot}%{_mandir}/man1/slogin.1 && \ - ln -s %{_mandir}/man1/ssh.1.gz \ - %{buildroot}%{_mandir}/man1/slogin.1.gz - - -%Clean -#%{rmDESTDIR} -[ %{buildroot} != "/" ] && rm -rf %{buildroot} - -%Post -# Generate host key when none is present to get up and running, -# both client and server require this for host-based auth! -# ssh-host-keygen checks for existing keys. -/usr/sbin/ssh-host-keygen -: # to protect the rpm database - -%pre server -%{_sbindir}/groupadd -g %{sshd_gid} sshd 2>/dev/null || : -%{_sbindir}/useradd -d /var/empty/sshd -s /bin/false -u %{sshd_uid} \ - -c "SSH Daemon virtual user" -g sshd sshd 2>/dev/null || : -: # to protect the rpm database - -%Post server -if [ -x %{LSBinit}-install ]; then - %{LSBinit}-install sshd -else - lisa --SysV-init install sshd S55 2:3:4:5 K45 0:1:6 -fi - -! %{SVIdir}/sshd status || %{SVIdir}/sshd restart -: # to protect the rpm database - - -%PreUn server -[ "$1" = 0 ] || exit 0 - -! %{SVIdir}/sshd status || %{SVIdir}/sshd stop -: # to protect the rpm database - - -%PostUn server -if [ -x %{LSBinit}-remove ]; then - %{LSBinit}-remove sshd -else - lisa --SysV-init remove sshd $1 -fi -: # to protect the rpm database - - -%Files -%defattr(-,root,root) -%dir %{_sysconfdir} -%config %{_sysconfdir}/ssh_config -%{_bindir}/scp -%{_bindir}/sftp -%{_bindir}/ssh -%{_bindir}/slogin -%{_bindir}/ssh-add -%attr(2755,root,nobody) %{_bindir}/ssh-agent -%{_bindir}/ssh-keygen -%{_bindir}/ssh-keyscan -%dir %{_libexecdir} -%attr(4711,root,root) %{_libexecdir}/ssh-keysign -%{_sbindir}/ssh-host-keygen -%dir %{_defaultdocdir}/%{name}-%{version} -%{_defaultdocdir}/%{name}-%{version}/CREDITS -%{_defaultdocdir}/%{name}-%{version}/ChangeLog -%{_defaultdocdir}/%{name}-%{version}/LICENCE -%{_defaultdocdir}/%{name}-%{version}/OVERVIEW -%{_defaultdocdir}/%{name}-%{version}/README* -%{_defaultdocdir}/%{name}-%{version}/TODO -%{_defaultdocdir}/%{name}-%{version}/faq.html -%{_mandir}/man1/* -%{_mandir}/man8/ssh-keysign.8.gz -%{_mandir}/man5/ssh_config.5.gz - -%Files server -%defattr(-,root,root) -%dir %{_var}/empty/sshd -%config %{SVIdir}/sshd -%config /etc/pam.d/sshd -%config %{_sysconfdir}/moduli -%config %{_sysconfdir}/sshd_config -%config %{SVIcdir}/sshd -%{_libexecdir}/sftp-server -%{_sbindir}/sshd -%{_mandir}/man5/sshd_config.5.gz -%{_mandir}/man8/sftp-server.8.gz -%{_mandir}/man8/sshd.8.gz - -%Files askpass -%defattr(-,root,root) -%{_libexecdir}/ssh-askpass -%{_libexecdir}/x11-ssh-askpass -%{_defaultdocdir}/%{name}-%{version}/%{askpass} - - -%ChangeLog -* Mon Jan 01 1998 ... -Template Version: 1.31 - -$Id: openssh.spec,v 1.49 2004/03/21 22:40:04 djm Exp $ diff --git a/crypto/openssh/contrib/caldera/ssh-host-keygen b/crypto/openssh/contrib/caldera/ssh-host-keygen deleted file mode 100755 index 3c5c171..0000000 --- a/crypto/openssh/contrib/caldera/ssh-host-keygen +++ /dev/null @@ -1,36 +0,0 @@ -#! /bin/sh -# -# $Id: ssh-host-keygen,v 1.2 2003/11/21 12:48:57 djm Exp $ -# -# This script is normally run only *once* for a given host -# (in a given period of time) -- on updates/upgrades/recovery -# the ssh_host_key* files _should_ be retained! Otherwise false -# "man-in-the-middle-attack" alerts will frighten unsuspecting -# clients... - -keydir=@sysconfdir@ -keygen=@sshkeygen@ - -if [ -f $keydir/ssh_host_key -o \ - -f $keydir/ssh_host_key.pub ]; then - echo "You already have an SSH1 RSA host key in $keydir/ssh_host_key." -else - echo "Generating 1024 bit SSH1 RSA host key." - $keygen -b 1024 -t rsa1 -f $keydir/ssh_host_key -C '' -N '' -fi - -if [ -f $keydir/ssh_host_rsa_key -o \ - -f $keydir/ssh_host_rsa_key.pub ]; then - echo "You already have an SSH2 RSA host key in $keydir/ssh_host_rsa_key." -else - echo "Generating 1024 bit SSH2 RSA host key." - $keygen -b 1024 -t rsa -f $keydir/ssh_host_rsa_key -C '' -N '' -fi - -if [ -f $keydir/ssh_host_dsa_key -o \ - -f $keydir/ssh_host_dsa_key.pub ]; then - echo "You already have an SSH2 DSA host key in $keydir/ssh_host_dsa_key." -else - echo "Generating SSH2 DSA host key." - $keygen -t dsa -f $keydir/ssh_host_dsa_key -C '' -N '' -fi diff --git a/crypto/openssh/contrib/caldera/sshd.init b/crypto/openssh/contrib/caldera/sshd.init deleted file mode 100755 index 983146f..0000000 --- a/crypto/openssh/contrib/caldera/sshd.init +++ /dev/null @@ -1,125 +0,0 @@ -#! /bin/bash -# -# $Id: sshd.init,v 1.4 2003/11/21 12:48:57 djm Exp $ -# -### BEGIN INIT INFO -# Provides: -# Required-Start: $network -# Required-Stop: -# Default-Start: 3 4 5 -# Default-Stop: 0 1 2 6 -# Description: sshd -# Bring up/down the OpenSSH secure shell daemon. -### END INIT INFO -# -# Written by Miquel van Smoorenburg <miquels@drinkel.ow.org>. -# Modified for Debian GNU/Linux by Ian Murdock <imurdock@gnu.ai.mit.edu>. -# Modified for OpenLinux by Raymund Will <ray@caldera.de> - -NAME=sshd -DAEMON=/usr/sbin/$NAME -# Hack-Alert(TM)! This is necessary to get around the 'reload'-problem -# created by recent OpenSSH daemon/ssd combinations. See Caldera internal -# PR [linux/8278] for details... -PIDF=/var/run/$NAME.pid -NAME=$DAEMON - -_status() { - [ -z "$1" ] || local pidf="$1" - local ret=-1 - local pid - if [ -n "$pidf" ] && [ -r "$pidf" ]; then - pid=$(head -1 $pidf) - else - pid=$(pidof $NAME) - fi - - if [ ! -e $SVIlock ]; then - # no lock-file => not started == stopped? - ret=3 - elif [ -n "$pidf" -a ! -f "$pidf" ] || [ -z "$pid" ]; then - # pid-file given but not present or no pid => died, but was not stopped - ret=2 - elif [ -r /proc/$pid/cmdline ] && - echo -ne $NAME'\000' | cmp -s - /proc/$pid/cmdline; then - # pid-file given and present or pid found => check process... - # but don't compare exe, as this will fail after an update! - # compares OK => all's well, that ends well... - ret=0 - else - # no such process or exe does not match => stale pid-file or process died - # just recently... - ret=1 - fi - return $ret -} - -# Source function library (and set vital variables). -. @SVIdir@/functions - -case "$1" in - start) - [ ! -e $SVIlock ] || exit 0 - [ -x $DAEMON ] || exit 5 - SVIemptyConfig @sysconfdir@/sshd_config && exit 6 - - if [ ! \( -f @sysconfdir@/ssh_host_key -a \ - -f @sysconfdir@/ssh_host_key.pub \) -a \ - ! \( -f @sysconfdir@/ssh_host_rsa_key -a \ - -f @sysconfdir@/ssh_host_rsa_key.pub \) -a \ - ! \( -f @sysconfdir@/ssh_host_dsa_key -a \ - -f @sysconfdir@/ssh_host_dsa_key.pub \) ]; then - - echo "$SVIsubsys: host key not initialized: skipped!" - echo "$SVIsubsys: use ssh-host-keygen to generate one!" - exit 6 - fi - - echo -n "Starting $SVIsubsys services: " - ssd -S -x $DAEMON -n $NAME -- $OPTIONS - ret=$? - - echo "." - touch $SVIlock - ;; - - stop) - [ -e $SVIlock ] || exit 0 - - echo -n "Stopping $SVIsubsys services: " - ssd -K -p $PIDF -n $NAME - ret=$? - - echo "." - rm -f $SVIlock - ;; - - force-reload|reload) - [ -e $SVIlock ] || exit 0 - - echo "Reloading $SVIsubsys configuration files: " - ssd -K --signal 1 -q -p $PIDF -n $NAME - ret=$? - echo "done." - ;; - - restart) - $0 stop - $0 start - ret=$? - ;; - - status) - _status $PIDF - ret=$? - ;; - - *) - echo "Usage: $SVIscript {[re]start|stop|[force-]reload|status}" - ret=2 - ;; - -esac - -exit $ret - diff --git a/crypto/openssh/contrib/caldera/sshd.pam b/crypto/openssh/contrib/caldera/sshd.pam deleted file mode 100644 index 26dcb34..0000000 --- a/crypto/openssh/contrib/caldera/sshd.pam +++ /dev/null @@ -1,8 +0,0 @@ -#%PAM-1.0 -auth required /lib/security/pam_pwdb.so shadow nodelay -auth required /lib/security/pam_nologin.so -account required /lib/security/pam_pwdb.so -password required /lib/security/pam_cracklib.so -password required /lib/security/pam_pwdb.so shadow nullok use_authtok -session required /lib/security/pam_pwdb.so -session required /lib/security/pam_limits.so diff --git a/crypto/openssh/contrib/cygwin/Makefile b/crypto/openssh/contrib/cygwin/Makefile deleted file mode 100644 index 09e8ea2..0000000 --- a/crypto/openssh/contrib/cygwin/Makefile +++ /dev/null @@ -1,56 +0,0 @@ -srcdir=../.. -prefix=/usr -exec_prefix=$(prefix) -bindir=$(prefix)/bin -datadir=$(prefix)/share -docdir=$(datadir)/doc -sshdocdir=$(docdir)/openssh -cygdocdir=$(docdir)/Cygwin -sysconfdir=/etc -defaultsdir=$(sysconfdir)/defaults/etc -PRIVSEP_PATH=/var/empty -INSTALL=/usr/bin/install -c - -DESTDIR= - -all: - @echo - @echo "Use \`make cygwin-postinstall DESTDIR=[package directory]'" - @echo "Be sure having DESTDIR set correctly!" - @echo - -move-config-files: $(DESTDIR)$(sysconfdir)/ssh_config $(DESTDIR)$(sysconfdir)/sshd_config - $(srcdir)/mkinstalldirs $(DESTDIR)$(defaultsdir) - mv $(DESTDIR)$(sysconfdir)/ssh_config $(DESTDIR)$(defaultsdir) - mv $(DESTDIR)$(sysconfdir)/sshd_config $(DESTDIR)$(defaultsdir) - -remove-empty-dir: - rm -rf $(DESTDIR)$(PRIVSEP_PATH) - -install-sshdoc: - $(srcdir)/mkinstalldirs $(DESTDIR)$(sshdocdir) - $(INSTALL) -m 644 $(srcdir)/CREDITS $(DESTDIR)$(sshdocdir)/CREDITS - $(INSTALL) -m 644 $(srcdir)/ChangeLog $(DESTDIR)$(sshdocdir)/ChangeLog - $(INSTALL) -m 644 $(srcdir)/LICENCE $(DESTDIR)$(sshdocdir)/LICENCE - $(INSTALL) -m 644 $(srcdir)/OVERVIEW $(DESTDIR)$(sshdocdir)/OVERVIEW - $(INSTALL) -m 644 $(srcdir)/README $(DESTDIR)$(sshdocdir)/README - $(INSTALL) -m 644 $(srcdir)/README.dns $(DESTDIR)$(sshdocdir)/README.dns - $(INSTALL) -m 644 $(srcdir)/README.privsep $(DESTDIR)$(sshdocdir)/README.privsep - $(INSTALL) -m 644 $(srcdir)/README.smartcard $(DESTDIR)$(sshdocdir)/README.smartcard - $(INSTALL) -m 644 $(srcdir)/RFC.nroff $(DESTDIR)$(sshdocdir)/RFC.nroff - $(INSTALL) -m 644 $(srcdir)/TODO $(DESTDIR)$(sshdocdir)/TODO - $(INSTALL) -m 644 $(srcdir)/WARNING.RNG $(DESTDIR)$(sshdocdir)/WARNING.RNG - -install-cygwindoc: README - $(srcdir)/mkinstalldirs $(DESTDIR)$(cygdocdir) - $(INSTALL) -m 644 README $(DESTDIR)$(cygdocdir)/openssh.README - -install-doc: install-sshdoc install-cygwindoc - -install-scripts: ssh-host-config ssh-user-config - $(srcdir)/mkinstalldirs $(DESTDIR)$(bindir) - $(INSTALL) -m 755 ssh-host-config $(DESTDIR)$(bindir)/ssh-host-config - $(INSTALL) -m 755 ssh-user-config $(DESTDIR)$(bindir)/ssh-user-config - -cygwin-postinstall: move-config-files remove-empty-dir install-doc install-scripts - @echo "Cygwin specific configuration finished." diff --git a/crypto/openssh/contrib/cygwin/README b/crypto/openssh/contrib/cygwin/README deleted file mode 100644 index fc0a2f6..0000000 --- a/crypto/openssh/contrib/cygwin/README +++ /dev/null @@ -1,224 +0,0 @@ -This package describes important Cygwin specific stuff concerning OpenSSH. - -The binary package is usually built for recent Cygwin versions and might -not run on older versions. Please check http://cygwin.com/ for information -about current Cygwin releases. - -Build instructions are at the end of the file. - -=========================================================================== -Important change since 3.7.1p2-2: - -The ssh-host-config file doesn't create the /etc/ssh_config and -/etc/sshd_config files from builtin here-scripts anymore, but it uses -skeleton files installed in /etc/defaults/etc. - -Also it now tries hard to create appropriate permissions on files. -Same applies for ssh-user-config. - -After creating the sshd service with ssh-host-config, it's advisable to -call ssh-user-config for all affected users, also already exising user -configurations. In the latter case, file and directory permissions are -checked and changed, if requireed to match the host configuration. - -Important note for Windows 2003 Server users: ---------------------------------------------- - -2003 Server has a funny new feature. When starting services under SYSTEM -account, these services have nearly all user rights which SYSTEM holds... -except for the "Create a token object" right, which is needed to allow -public key authentication :-( - -There's no way around this, except for creating a substitute account which -has the appropriate privileges. Basically, this account should be member -of the administrators group, plus it should have the following user rights: - - Create a token object - Logon as a service - Replace a process level token - Increase Quota - -The ssh-host-config script asks you, if it should create such an account, -called "sshd_server". If you say "no" here, you're on your own. Please -follow the instruction in ssh-host-config exactly if possible. Note that -ssh-user-config sets the permissions on 2003 Server machines dependent of -whether a sshd_server account exists or not. -=========================================================================== - -=========================================================================== -Important change since 3.4p1-2: - -This version adds privilege separation as default setting, see -/usr/doc/openssh/README.privsep. According to that document the -privsep feature requires a non-privileged account called 'sshd'. - -The new ssh-host-config file which is part of this version asks -to create 'sshd' as local user if you want to use privilege -separation. If you confirm, it creates that NT user and adds -the necessary entry to /etc/passwd. - -On 9x/Me systems the script just sets UsePrivilegeSeparation to "no" -since that feature doesn't make any sense on a system which doesn't -differ between privileged and unprivileged users. - -The new ssh-host-config script also adds the /var/empty directory -needed by privilege separation. When creating the /var/empty directory -by yourself, please note that in contrast to the README.privsep document -the owner sshould not be "root" but the user which is running sshd. So, -in the standard configuration this is SYSTEM. The ssh-host-config script -chowns /var/empty accordingly. -=========================================================================== - -=========================================================================== -Important change since 3.0.1p1-2: - -This version introduces the ability to register sshd as service on -Windows 9x/Me systems. This is done only when the options -D and/or --d are not given. -=========================================================================== - -=========================================================================== -Important change since 2.9p2: - -Since Cygwin is able to switch user context without password beginning -with version 1.3.2, OpenSSH now allows to do so when it's running under -a version >= 1.3.2. Keep in mind that `ntsec' has to be activated to -allow that feature. -=========================================================================== - -=========================================================================== -Important change since 2.3.0p1: - -When using `ntea' or `ntsec' you now have to care for the ownership -and permission bits of your host key files and your private key files. -The host key files have to be owned by the NT account which starts -sshd. The user key files have to be owned by the user. The permission -bits of the private key files (host and user) have to be at least -rw------- (0600)! - -Note that this is forced under `ntsec' only if the files are on a NTFS -filesystem (which is recommended) due to the lack of any basic security -features of the FAT/FAT32 filesystems. -=========================================================================== - -If you are installing OpenSSH the first time, you can generate global config -files and server keys by running - - /usr/bin/ssh-host-config - -Note that this binary archive doesn't contain default config files in /etc. -That files are only created if ssh-host-config is started. - -If you are updating your installation you may run the above ssh-host-config -as well to move your configuration files to the new location and to -erase the files at the old location. - -To support testing and unattended installation ssh-host-config got -some options: - -usage: ssh-host-config [OPTION]... -Options: - --debug -d Enable shell's debug output. - --yes -y Answer all questions with "yes" automatically. - --no -n Answer all questions with "no" automatically. - --cygwin -c <options> Use "options" as value for CYGWIN environment var. - --port -p <n> sshd listens on port n. - --pwd -w <passwd> Use "pwd" as password for user 'sshd_server'. - -Additionally ssh-host-config now asks if it should install sshd as a -service when running under NT/W2K. This requires cygrunsrv installed. - -You can create the private and public keys for a user now by running - - /usr/bin/ssh-user-config - -under the users account. - -To support testing and unattended installation ssh-user-config got -some options as well: - -usage: ssh-user-config [OPTION]... -Options: - --debug -d Enable shell's debug output. - --yes -y Answer all questions with "yes" automatically. - --no -n Answer all questions with "no" automatically. - --passphrase -p word Use "word" as passphrase automatically. - -Install sshd as daemon via cygrunsrv.exe (recommended on NT/W2K), via inetd -(results in very slow deamon startup!) or from the command line (recommended -on 9X/ME). - -If you start sshd as deamon via cygrunsrv.exe you MUST give the -"-D" option to sshd. Otherwise the service can't get started at all. - -If starting via inetd, copy sshd to eg. /usr/sbin/in.sshd and add the -following line to your inetd.conf file: - -ssh stream tcp nowait root /usr/sbin/in.sshd sshd -i - -Moreover you'll have to add the following line to your -${SYSTEMROOT}/system32/drivers/etc/services file: - - ssh 22/tcp #SSH daemon - -Please note that OpenSSH does never use the value of $HOME to -search for the users configuration files! It always uses the -value of the pw_dir field in /etc/passwd as the home directory. -If no home diretory is set in /etc/passwd, the root directory -is used instead! - -You may use all features of the CYGWIN=ntsec setting the same -way as they are used by Cygwin's login(1) port: - - The pw_gecos field may contain an additional field, that begins - with (upper case!) "U-", followed by the domain and the username - separated by a backslash. - CAUTION: The SID _must_ remain the _last_ field in pw_gecos! - BTW: The field separator in pw_gecos is the comma. - The username in pw_name itself may be any nice name: - - domuser::1104:513:John Doe,U-domain\user,S-1-5-21-... - - Now you may use `domuser' as your login name with telnet! - This is possible additionally for local users, if you don't like - your NT login name ;-) You only have to leave out the domain: - - locuser::1104:513:John Doe,U-user,S-1-5-21-... - -Note that the CYGWIN=ntsec setting is required for public key authentication. - -SSH2 server and user keys are generated by the `ssh-*-config' scripts -as well. - -If you want to build from source, the following options to -configure are used for the Cygwin binary distribution: - - --prefix=/usr \ - --sysconfdir=/etc \ - --libexecdir='$(sbindir)' \ - --localstatedir=/var \ - --datadir='$(prefix)/share' \ - --mandir='$(datadir)/man' \ - --with-tcp-wrappers - -If you want to create a Cygwin package, equivalent to the one -in the Cygwin binary distribution, install like this: - - mkdir /tmp/cygwin-ssh - cd $(builddir) - make install DESTDIR=/tmp/cygwin-ssh - cd $(srcdir)/contrib/cygwin - make cygwin-postinstall DESTDIR=/tmp/cygwin-ssh - cd /tmp/cygwin-ssh - find * \! -type d | tar cvjfT my-openssh.tar.bz2 - - -You must have installed the zlib and openssl-devel packages to be able to -build OpenSSH! - -Please send requests, error reports etc. to cygwin@cygwin.com. - -Have fun, - -Corinna Vinschen -Cygwin Developer -Red Hat Inc. diff --git a/crypto/openssh/contrib/cygwin/ssh-host-config b/crypto/openssh/contrib/cygwin/ssh-host-config deleted file mode 100644 index 9c0dabf..0000000 --- a/crypto/openssh/contrib/cygwin/ssh-host-config +++ /dev/null @@ -1,592 +0,0 @@ -#!/bin/bash -# -# ssh-host-config, Copyright 2000, 2001, 2002, 2003 Red Hat Inc. -# -# This file is part of the Cygwin port of OpenSSH. - -# Subdirectory where the new package is being installed -PREFIX=/usr - -# Directory where the config files are stored -SYSCONFDIR=/etc -LOCALSTATEDIR=/var - -progname=$0 -auto_answer="" -port_number=22 - -privsep_configured=no -privsep_used=yes -sshd_in_passwd=no -sshd_in_sam=no - -request() -{ - if [ "${auto_answer}" = "yes" ] - then - echo "$1 (yes/no) yes" - return 0 - elif [ "${auto_answer}" = "no" ] - then - echo "$1 (yes/no) no" - return 1 - fi - - answer="" - while [ "X${answer}" != "Xyes" -a "X${answer}" != "Xno" ] - do - echo -n "$1 (yes/no) " - read -e answer - done - if [ "X${answer}" = "Xyes" ] - then - return 0 - else - return 1 - fi -} - -# Check options - -while : -do - case $# in - 0) - break - ;; - esac - - option=$1 - shift - - case "${option}" in - -d | --debug ) - set -x - ;; - - -y | --yes ) - auto_answer=yes - ;; - - -n | --no ) - auto_answer=no - ;; - - -c | --cygwin ) - cygwin_value="$1" - shift - ;; - - -p | --port ) - port_number=$1 - shift - ;; - - -w | --pwd ) - password_value="$1" - shift - ;; - - *) - echo "usage: ${progname} [OPTION]..." - echo - echo "This script creates an OpenSSH host configuration." - echo - echo "Options:" - echo " --debug -d Enable shell's debug output." - echo " --yes -y Answer all questions with \"yes\" automatically." - echo " --no -n Answer all questions with \"no\" automatically." - echo " --cygwin -c <options> Use \"options\" as value for CYGWIN environment var." - echo " --port -p <n> sshd listens on port n." - echo " --pwd -w <passwd> Use \"pwd\" as password for user 'sshd_server'." - echo - exit 1 - ;; - - esac -done - -# Check if running on NT -_sys="`uname`" -_nt=`expr "${_sys}" : "CYGWIN_NT"` -# If running on NT, check if running under 2003 Server or later -if [ ${_nt} -gt 0 ] -then - _nt2003=`uname | awk -F- '{print ( $2 >= 5.2 ) ? 1 : 0;}'` -fi - -# Check for running ssh/sshd processes first. Refuse to do anything while -# some ssh processes are still running - -if ps -ef | grep -v grep | grep -q ssh -then - echo - echo "There are still ssh processes running. Please shut them down first." - echo - exit 1 -fi - -# Check for ${SYSCONFDIR} directory - -if [ -e "${SYSCONFDIR}" -a ! -d "${SYSCONFDIR}" ] -then - echo - echo "${SYSCONFDIR} is existant but not a directory." - echo "Cannot create global configuration files." - echo - exit 1 -fi - -# Create it if necessary - -if [ ! -e "${SYSCONFDIR}" ] -then - mkdir "${SYSCONFDIR}" - if [ ! -e "${SYSCONFDIR}" ] - then - echo - echo "Creating ${SYSCONFDIR} directory failed" - echo - exit 1 - fi -fi - -# Create /var/log and /var/log/lastlog if not already existing - -if [ -f ${LOCALSTATEDIR}/log ] -then - echo "Creating ${LOCALSTATEDIR}/log failed!" -else - if [ ! -d ${LOCALSTATEDIR}/log ] - then - mkdir -p ${LOCALSTATEDIR}/log - fi - if [ -d ${LOCALSTATEDIR}/log/lastlog ] - then - chmod 777 ${LOCALSTATEDIR}/log/lastlog - elif [ ! -f ${LOCALSTATEDIR}/log/lastlog ] - then - cat /dev/null > ${LOCALSTATEDIR}/log/lastlog - chmod 666 ${LOCALSTATEDIR}/log/lastlog - fi -fi - -# Create /var/empty file used as chroot jail for privilege separation -if [ -f ${LOCALSTATEDIR}/empty ] -then - echo "Creating ${LOCALSTATEDIR}/empty failed!" -else - mkdir -p ${LOCALSTATEDIR}/empty - if [ ${_nt} -gt 0 ] - then - chmod 755 ${LOCALSTATEDIR}/empty - fi -fi - -# First generate host keys if not already existing - -if [ ! -f "${SYSCONFDIR}/ssh_host_key" ] -then - echo "Generating ${SYSCONFDIR}/ssh_host_key" - ssh-keygen -t rsa1 -f ${SYSCONFDIR}/ssh_host_key -N '' > /dev/null -fi - -if [ ! -f "${SYSCONFDIR}/ssh_host_rsa_key" ] -then - echo "Generating ${SYSCONFDIR}/ssh_host_rsa_key" - ssh-keygen -t rsa -f ${SYSCONFDIR}/ssh_host_rsa_key -N '' > /dev/null -fi - -if [ ! -f "${SYSCONFDIR}/ssh_host_dsa_key" ] -then - echo "Generating ${SYSCONFDIR}/ssh_host_dsa_key" - ssh-keygen -t dsa -f ${SYSCONFDIR}/ssh_host_dsa_key -N '' > /dev/null -fi - -# Check if ssh_config exists. If yes, ask for overwriting - -if [ -f "${SYSCONFDIR}/ssh_config" ] -then - if request "Overwrite existing ${SYSCONFDIR}/ssh_config file?" - then - rm -f "${SYSCONFDIR}/ssh_config" - if [ -f "${SYSCONFDIR}/ssh_config" ] - then - echo "Can't overwrite. ${SYSCONFDIR}/ssh_config is write protected." - fi - fi -fi - -# Create default ssh_config from skeleton file in /etc/defaults/etc - -if [ ! -f "${SYSCONFDIR}/ssh_config" ] -then - echo "Generating ${SYSCONFDIR}/ssh_config file" - cp ${SYSCONFDIR}/defaults/etc/ssh_config ${SYSCONFDIR}/ssh_config - if [ "${port_number}" != "22" ] - then - echo "Host localhost" >> ${SYSCONFDIR}/ssh_config - echo " Port ${port_number}" >> ${SYSCONFDIR}/ssh_config - fi -fi - -# Check if sshd_config exists. If yes, ask for overwriting - -if [ -f "${SYSCONFDIR}/sshd_config" ] -then - if request "Overwrite existing ${SYSCONFDIR}/sshd_config file?" - then - rm -f "${SYSCONFDIR}/sshd_config" - if [ -f "${SYSCONFDIR}/sshd_config" ] - then - echo "Can't overwrite. ${SYSCONFDIR}/sshd_config is write protected." - fi - else - grep -q UsePrivilegeSeparation ${SYSCONFDIR}/sshd_config && privsep_configured=yes - fi -fi - -# Prior to creating or modifying sshd_config, care for privilege separation - -if [ "${privsep_configured}" != "yes" ] -then - if [ ${_nt} -gt 0 ] - then - echo "Privilege separation is set to yes by default since OpenSSH 3.3." - echo "However, this requires a non-privileged account called 'sshd'." - echo "For more info on privilege separation read /usr/share/doc/openssh/README.privsep." - echo - if request "Should privilege separation be used?" - then - privsep_used=yes - grep -q '^sshd:' ${SYSCONFDIR}/passwd && sshd_in_passwd=yes - net user sshd >/dev/null 2>&1 && sshd_in_sam=yes - if [ "${sshd_in_passwd}" != "yes" ] - then - if [ "${sshd_in_sam}" != "yes" ] - then - echo "Warning: The following function requires administrator privileges!" - if request "Should this script create a local user 'sshd' on this machine?" - then - dos_var_empty=`cygpath -w ${LOCALSTATEDIR}/empty` - net user sshd /add /fullname:"sshd privsep" "/homedir:${dos_var_empty}" /active:no > /dev/null 2>&1 && sshd_in_sam=yes - if [ "${sshd_in_sam}" != "yes" ] - then - echo "Warning: Creating the user 'sshd' failed!" - fi - fi - fi - if [ "${sshd_in_sam}" != "yes" ] - then - echo "Warning: Can't create user 'sshd' in ${SYSCONFDIR}/passwd!" - echo " Privilege separation set to 'no' again!" - echo " Check your ${SYSCONFDIR}/sshd_config file!" - privsep_used=no - else - mkpasswd -l -u sshd | sed -e 's/bash$/false/' >> ${SYSCONFDIR}/passwd - fi - fi - else - privsep_used=no - fi - else - # On 9x don't use privilege separation. Since security isn't - # available it just adds useless additional processes. - privsep_used=no - fi -fi - -# Create default sshd_config from skeleton files in /etc/defaults/etc or -# modify to add the missing privsep configuration option - -if [ ! -f "${SYSCONFDIR}/sshd_config" ] -then - echo "Generating ${SYSCONFDIR}/sshd_config file" - sed -e "s/^#UsePrivilegeSeparation yes/UsePrivilegeSeparation ${privsep_used}/ - s/^#Port 22/Port ${port_number}/ - s/^#StrictModes yes/StrictModes no/" \ - < ${SYSCONFDIR}/defaults/etc/sshd_config \ - > ${SYSCONFDIR}/sshd_config -elif [ "${privsep_configured}" != "yes" ] -then - echo >> ${SYSCONFDIR}/sshd_config - echo "UsePrivilegeSeparation ${privsep_used}" >> ${SYSCONFDIR}/sshd_config -fi - -# Care for services file -_my_etcdir="/ssh-host-config.$$" -if [ ${_nt} -gt 0 ] -then - _win_etcdir="${SYSTEMROOT}\\system32\\drivers\\etc" - _services="${_my_etcdir}/services" - # On NT, 27 spaces, no space after the hash - _spaces=" #" -else - _win_etcdir="${WINDIR}" - _services="${_my_etcdir}/SERVICES" - # On 9x, 18 spaces (95 is very touchy), a space after the hash - _spaces=" # " -fi -_serv_tmp="${_my_etcdir}/srv.out.$$" - -mount -t -f "${_win_etcdir}" "${_my_etcdir}" - -# Depends on the above mount -_wservices=`cygpath -w "${_services}"` - -# Remove sshd 22/port from services -if [ `grep -q 'sshd[ \t][ \t]*22' "${_services}"; echo $?` -eq 0 ] -then - grep -v 'sshd[ \t][ \t]*22' "${_services}" > "${_serv_tmp}" - if [ -f "${_serv_tmp}" ] - then - if mv "${_serv_tmp}" "${_services}" - then - echo "Removing sshd from ${_wservices}" - else - echo "Removing sshd from ${_wservices} failed!" - fi - rm -f "${_serv_tmp}" - else - echo "Removing sshd from ${_wservices} failed!" - fi -fi - -# Add ssh 22/tcp and ssh 22/udp to services -if [ `grep -q 'ssh[ \t][ \t]*22' "${_services}"; echo $?` -ne 0 ] -then - if awk '{ if ( $2 ~ /^23\/tcp/ ) print "ssh 22/tcp'"${_spaces}"'SSH Remote Login Protocol\nssh 22/udp'"${_spaces}"'SSH Remote Login Protocol"; print $0; }' < "${_services}" > "${_serv_tmp}" - then - if mv "${_serv_tmp}" "${_services}" - then - echo "Added ssh to ${_wservices}" - else - echo "Adding ssh to ${_wservices} failed!" - fi - rm -f "${_serv_tmp}" - else - echo "WARNING: Adding ssh to ${_wservices} failed!" - fi -fi - -umount "${_my_etcdir}" - -# Care for inetd.conf file -_inetcnf="${SYSCONFDIR}/inetd.conf" -_inetcnf_tmp="${SYSCONFDIR}/inetd.conf.$$" - -if [ -f "${_inetcnf}" ] -then - # Check if ssh service is already in use as sshd - with_comment=1 - grep -q '^[ \t]*sshd' "${_inetcnf}" && with_comment=0 - # Remove sshd line from inetd.conf - if [ `grep -q '^[# \t]*sshd' "${_inetcnf}"; echo $?` -eq 0 ] - then - grep -v '^[# \t]*sshd' "${_inetcnf}" >> "${_inetcnf_tmp}" - if [ -f "${_inetcnf_tmp}" ] - then - if mv "${_inetcnf_tmp}" "${_inetcnf}" - then - echo "Removed sshd from ${_inetcnf}" - else - echo "Removing sshd from ${_inetcnf} failed!" - fi - rm -f "${_inetcnf_tmp}" - else - echo "Removing sshd from ${_inetcnf} failed!" - fi - fi - - # Add ssh line to inetd.conf - if [ `grep -q '^[# \t]*ssh' "${_inetcnf}"; echo $?` -ne 0 ] - then - if [ "${with_comment}" -eq 0 ] - then - echo 'ssh stream tcp nowait root /usr/sbin/sshd sshd -i' >> "${_inetcnf}" - else - echo '# ssh stream tcp nowait root /usr/sbin/sshd sshd -i' >> "${_inetcnf}" - fi - echo "Added ssh to ${_inetcnf}" - fi -fi - -# On NT ask if sshd should be installed as service -if [ ${_nt} -gt 0 ] -then - # But only if it is not already installed - if ! cygrunsrv -Q sshd > /dev/null 2>&1 - then - echo - echo - echo "Warning: The following functions require administrator privileges!" - echo - echo "Do you want to install sshd as service?" - if request "(Say \"no\" if it's already installed as service)" - then - if [ $_nt2003 -gt 0 ] - then - grep -q '^sshd_server:' ${SYSCONFDIR}/passwd && sshd_server_in_passwd=yes - if [ "${sshd_server_in_passwd}" = "yes" ] - then - # Drop sshd_server from passwd since it could have wrong settings - grep -v '^sshd_server:' ${SYSCONFDIR}/passwd > ${SYSCONFDIR}/passwd.$$ - rm -f ${SYSCONFDIR}/passwd - mv ${SYSCONFDIR}/passwd.$$ ${SYSCONFDIR}/passwd - chmod g-w,o-w ${SYSCONFDIR}/passwd - fi - net user sshd_server >/dev/null 2>&1 && sshd_server_in_sam=yes - if [ "${sshd_server_in_sam}" != "yes" ] - then - echo - echo "You appear to be running Windows 2003 Server or later. On 2003 and" - echo "later systems, it's not possible to use the LocalSystem account" - echo "if sshd should allow passwordless logon (e. g. public key authentication)." - echo "If you want to enable that functionality, it's required to create a new" - echo "account 'sshd_server' with special privileges, which is then used to run" - echo "the sshd service under." - echo - echo "Should this script create a new local account 'sshd_server' which has" - if request "the required privileges?" - then - _admingroup=`awk -F: '{if ( $2 == "S-1-5-32-544" ) print $1;}' ${SYSCONFDIR}/group` - if [ -z "${_admingroup}" ] - then - echo "There's no group with SID S-1-5-32-544 (Local administrators group) in" - echo "your ${SYSCONFDIR}/group file. Please regenerate this entry using 'mkgroup -l'" - echo "and restart this script." - exit 1 - fi - dos_var_empty=`cygpath -w ${LOCALSTATEDIR}/empty` - while [ "${sshd_server_in_sam}" != "yes" ] - do - if [ -n "${password_value}" ] - then - _password="${password_value}" - # Allow to ask for password if first try fails - password_value="" - else - echo - echo "Please enter a password for new user 'sshd_server'. Please be sure that" - echo "this password matches the password rules given on your system." - echo -n "Entering no password will exit the configuration. PASSWORD=" - read -e _password - if [ -z "${_password}" ] - then - echo - echo "Exiting configuration. No user sshd_server has been created," - echo "no sshd service installed." - exit 1 - fi - fi - net user sshd_server "${_password}" /add /fullname:"sshd server account" "/homedir:${dos_var_empty}" /yes > /tmp/nu.$$ 2>&1 && sshd_server_in_sam=yes - if [ "${sshd_server_in_sam}" != "yes" ] - then - echo "Creating the user 'sshd_server' failed! Reason:" - cat /tmp/nu.$$ - rm /tmp/nu.$$ - fi - done - net localgroup "${_admingroup}" sshd_server /add > /dev/null 2>&1 && sshd_server_in_admingroup=yes - if [ "${sshd_server_in_admingroup}" != "yes" ] - then - echo "WARNING: Adding user sshd_server to local group ${_admingroup} failed!" - echo "Please add sshd_server to local group ${_admingroup} before" - echo "starting the sshd service!" - echo - fi - passwd_has_expiry_flags=`passwd -v | awk '/^passwd /{print ( $3 >= 1.5 ) ? "yes" : "no";}'` - if [ "${passwd_has_expiry_flags}" != "yes" ] - then - echo - echo "WARNING: User sshd_server has password expiry set to system default." - echo "Please check that password never expires or set it to your needs." - elif ! passwd -e sshd_server - then - echo - echo "WARNING: Setting password expiry for user sshd_server failed!" - echo "Please check that password never expires or set it to your needs." - fi - editrights -a SeAssignPrimaryTokenPrivilege -u sshd_server && - editrights -a SeCreateTokenPrivilege -u sshd_server && - editrights -a SeDenyInteractiveLogonRight -u sshd_server && - editrights -a SeDenyNetworkLogonRight -u sshd_server && - editrights -a SeDenyRemoteInteractiveLogonRight -u sshd_server && - editrights -a SeIncreaseQuotaPrivilege -u sshd_server && - editrights -a SeServiceLogonRight -u sshd_server && - sshd_server_got_all_rights="yes" - if [ "${sshd_server_got_all_rights}" != "yes" ] - then - echo - echo "Assigning the appropriate privileges to user 'sshd_server' failed!" - echo "Can't create sshd service!" - exit 1 - fi - echo - echo "User 'sshd_server' has been created with password '${_password}'." - echo "If you change the password, please keep in mind to change the password" - echo "for the sshd service, too." - echo - echo "Also keep in mind that the user sshd_server needs read permissions on all" - echo "users' .ssh/authorized_keys file to allow public key authentication for" - echo "these users!. (Re-)running ssh-user-config for each user will set the" - echo "required permissions correctly." - echo - fi - fi - if [ "${sshd_server_in_sam}" = "yes" ] - then - mkpasswd -l -u sshd_server | sed -e 's/bash$/false/' >> ${SYSCONFDIR}/passwd - fi - fi - if [ -n "${cygwin_value}" ] - then - _cygwin="${cygwin_value}" - else - echo - echo "Which value should the environment variable CYGWIN have when" - echo "sshd starts? It's recommended to set at least \"ntsec\" to be" - echo "able to change user context without password." - echo -n "Default is \"ntsec\". CYGWIN=" - read -e _cygwin - fi - [ -z "${_cygwin}" ] && _cygwin="ntsec" - if [ $_nt2003 -gt 0 -a "${sshd_server_in_sam}" = "yes" ] - then - if cygrunsrv -I sshd -d "CYGWIN sshd" -p /usr/sbin/sshd -a -D -u sshd_server -w "${_password}" -e "CYGWIN=${_cygwin}" - then - echo - echo "The service has been installed under sshd_server account." - echo "To start the service, call \`net start sshd' or \`cygrunsrv -S sshd'." - fi - else - if cygrunsrv -I sshd -d "CYGWIN sshd" -p /usr/sbin/sshd -a -D -e "CYGWIN=${_cygwin}" - then - echo - echo "The service has been installed under LocalSystem account." - echo "To start the service, call \`net start sshd' or \`cygrunsrv -S sshd'." - fi - fi - fi - # Now check if sshd has been successfully installed. This allows to - # set the ownership of the affected files correctly. - if cygrunsrv -Q sshd > /dev/null 2>&1 - then - if [ $_nt2003 -gt 0 -a "${sshd_server_in_sam}" = "yes" ] - then - _user="sshd_server" - else - _user="system" - fi - chown "${_user}" ${SYSCONFDIR}/ssh* - chown "${_user}".544 ${LOCALSTATEDIR}/empty - if [ -f ${LOCALSTATEDIR}/log/sshd.log ] - then - chown "${_user}".544 ${LOCALSTATEDIR}/log/sshd.log - fi - fi - fi -fi - -echo -echo "Host configuration finished. Have fun!" diff --git a/crypto/openssh/contrib/cygwin/ssh-user-config b/crypto/openssh/contrib/cygwin/ssh-user-config deleted file mode 100644 index fe07ce3..0000000 --- a/crypto/openssh/contrib/cygwin/ssh-user-config +++ /dev/null @@ -1,250 +0,0 @@ -#!/bin/sh -# -# ssh-user-config, Copyright 2000, 2001, 2002, 2003, Red Hat Inc. -# -# This file is part of the Cygwin port of OpenSSH. - -# Directory where the config files are stored -SYSCONFDIR=/etc - -progname=$0 -auto_answer="" -auto_passphrase="no" -passphrase="" - -request() -{ - if [ "${auto_answer}" = "yes" ] - then - return 0 - elif [ "${auto_answer}" = "no" ] - then - return 1 - fi - - answer="" - while [ "X${answer}" != "Xyes" -a "X${answer}" != "Xno" ] - do - echo -n "$1 (yes/no) " - read answer - done - if [ "X${answer}" = "Xyes" ] - then - return 0 - else - return 1 - fi -} - -# Check if running on NT -_sys="`uname -a`" -_nt=`expr "$_sys" : "CYGWIN_NT"` -# If running on NT, check if running under 2003 Server or later -if [ $_nt -gt 0 ] -then - _nt2003=`uname | awk -F- '{print ( $2 >= 5.2 ) ? 1 : 0;}'` -fi - -# Check options - -while : -do - case $# in - 0) - break - ;; - esac - - option=$1 - shift - - case "$option" in - -d | --debug ) - set -x - ;; - - -y | --yes ) - auto_answer=yes - ;; - - -n | --no ) - auto_answer=no - ;; - - -p | --passphrase ) - with_passphrase="yes" - passphrase=$1 - shift - ;; - - *) - echo "usage: ${progname} [OPTION]..." - echo - echo "This script creates an OpenSSH user configuration." - echo - echo "Options:" - echo " --debug -d Enable shell's debug output." - echo " --yes -y Answer all questions with \"yes\" automatically." - echo " --no -n Answer all questions with \"no\" automatically." - echo " --passphrase -p word Use \"word\" as passphrase automatically." - echo - exit 1 - ;; - - esac -done - -# Ask user if user identity should be generated - -if [ ! -f ${SYSCONFDIR}/passwd ] -then - echo "${SYSCONFDIR}/passwd is nonexistant. Please generate an ${SYSCONFDIR}/passwd file" - echo 'first using mkpasswd. Check if it contains an entry for you and' - echo 'please care for the home directory in your entry as well.' - exit 1 -fi - -uid=`id -u` -pwdhome=`awk -F: '{ if ( $3 == '${uid}' ) print $6; }' < ${SYSCONFDIR}/passwd` - -if [ "X${pwdhome}" = "X" ] -then - echo "There is no home directory set for you in ${SYSCONFDIR}/passwd." - echo 'Setting $HOME is not sufficient!' - exit 1 -fi - -if [ ! -d "${pwdhome}" ] -then - echo "${pwdhome} is set in ${SYSCONFDIR}/passwd as your home directory" - echo 'but it is not a valid directory. Cannot create user identity files.' - exit 1 -fi - -# If home is the root dir, set home to empty string to avoid error messages -# in subsequent parts of that script. -if [ "X${pwdhome}" = "X/" ] -then - # But first raise a warning! - echo "Your home directory in ${SYSCONFDIR}/passwd is set to root (/). This is not recommended!" - if request "Would you like to proceed anyway?" - then - pwdhome='' - else - exit 1 - fi -fi - -if [ -d "${pwdhome}" -a $_nt -gt 0 -a -n "`chmod -c g-w,o-w "${pwdhome}"`" ] -then - echo - echo 'WARNING: group and other have been revoked write permission to your home' - echo " directory ${pwdhome}." - echo ' This is required by OpenSSH to allow public key authentication using' - echo ' the key files stored in your .ssh subdirectory.' - echo ' Revert this change ONLY if you know what you are doing!' - echo -fi - -if [ -e "${pwdhome}/.ssh" -a ! -d "${pwdhome}/.ssh" ] -then - echo "${pwdhome}/.ssh is existant but not a directory. Cannot create user identity files." - exit 1 -fi - -if [ ! -e "${pwdhome}/.ssh" ] -then - mkdir "${pwdhome}/.ssh" - if [ ! -e "${pwdhome}/.ssh" ] - then - echo "Creating users ${pwdhome}/.ssh directory failed" - exit 1 - fi -fi - -if [ $_nt -gt 0 ] -then - _user="system" - if [ $_nt2003 -gt 0 ] - then - grep -q '^sshd_server:' ${SYSCONFDIR}/passwd && _user="sshd_server" - fi - if ! setfacl -m "u::rwx,u:${_user}:r--,g::---,o::---" "${pwdhome}/.ssh" - then - echo "${pwdhome}/.ssh couldn't be given the correct permissions." - echo "Please try to solve this problem first." - exit 1 - fi -fi - -if [ ! -f "${pwdhome}/.ssh/identity" ] -then - if request "Shall I create an SSH1 RSA identity file for you?" - then - echo "Generating ${pwdhome}/.ssh/identity" - if [ "${with_passphrase}" = "yes" ] - then - ssh-keygen -t rsa1 -N "${passphrase}" -f "${pwdhome}/.ssh/identity" > /dev/null - else - ssh-keygen -t rsa1 -f "${pwdhome}/.ssh/identity" > /dev/null - fi - if request "Do you want to use this identity to login to this machine?" - then - echo "Adding to ${pwdhome}/.ssh/authorized_keys" - cat "${pwdhome}/.ssh/identity.pub" >> "${pwdhome}/.ssh/authorized_keys" - fi - fi -fi - -if [ ! -f "${pwdhome}/.ssh/id_rsa" ] -then - if request "Shall I create an SSH2 RSA identity file for you? (yes/no) " - then - echo "Generating ${pwdhome}/.ssh/id_rsa" - if [ "${with_passphrase}" = "yes" ] - then - ssh-keygen -t rsa -N "${passphrase}" -f "${pwdhome}/.ssh/id_rsa" > /dev/null - else - ssh-keygen -t rsa -f "${pwdhome}/.ssh/id_rsa" > /dev/null - fi - if request "Do you want to use this identity to login to this machine?" - then - echo "Adding to ${pwdhome}/.ssh/authorized_keys" - cat "${pwdhome}/.ssh/id_rsa.pub" >> "${pwdhome}/.ssh/authorized_keys" - fi - fi -fi - -if [ ! -f "${pwdhome}/.ssh/id_dsa" ] -then - if request "Shall I create an SSH2 DSA identity file for you? (yes/no) " - then - echo "Generating ${pwdhome}/.ssh/id_dsa" - if [ "${with_passphrase}" = "yes" ] - then - ssh-keygen -t dsa -N "${passphrase}" -f "${pwdhome}/.ssh/id_dsa" > /dev/null - else - ssh-keygen -t dsa -f "${pwdhome}/.ssh/id_dsa" > /dev/null - fi - if request "Do you want to use this identity to login to this machine?" - then - echo "Adding to ${pwdhome}/.ssh/authorized_keys" - cat "${pwdhome}/.ssh/id_dsa.pub" >> "${pwdhome}/.ssh/authorized_keys" - fi - fi -fi - -if [ $_nt -gt 0 -a -e "${pwdhome}/.ssh/authorized_keys" ] -then - if ! setfacl -m "u::rw-,u:${_user}:r--,g::---,o::---" "${pwdhome}/.ssh/authorized_keys" - then - echo - echo "WARNING: Setting correct permissions to ${pwdhome}/.ssh/authorized_keys" - echo "failed. Please care for the correct permissions. The minimum requirement" - echo "is, the owner and ${_user} both need read permissions." - echo - fi -fi - -echo -echo "Configuration finished. Have fun!" diff --git a/crypto/openssh/contrib/findssl.sh b/crypto/openssh/contrib/findssl.sh deleted file mode 100644 index 0c08d4a..0000000 --- a/crypto/openssh/contrib/findssl.sh +++ /dev/null @@ -1,159 +0,0 @@ -#!/bin/sh -# -# findssl.sh -# Search for all instances of OpenSSL headers and libraries -# and print their versions. -# Intended to help diagnose OpenSSH's "OpenSSL headers do not -# match your library" errors. -# -# Written by Darren Tucker (dtucker at zip dot com dot au) -# This file is placed in the public domain. -# -# $Id: findssl.sh,v 1.2 2003/11/21 12:48:56 djm Exp $ -# 2002-07-27: Initial release. -# 2002-08-04: Added public domain notice. -# 2003-06-24: Incorporated readme, set library paths. First cvs version. -# -# "OpenSSL headers do not match your library" are usually caused by -# OpenSSH's configure picking up an older version of OpenSSL headers -# or libraries. You can use the following # procedure to help identify -# the cause. -# -# The output of configure will tell you the versions of the OpenSSL -# headers and libraries that were picked up, for example: -# -# checking OpenSSL header version... 90604f (OpenSSL 0.9.6d 9 May 2002) -# checking OpenSSL library version... 90602f (OpenSSL 0.9.6b [engine] 9 Jul 2001) -# checking whether OpenSSL's headers match the library... no -# configure: error: Your OpenSSL headers do not match your library -# -# Now run findssl.sh. This should identify the headers and libraries -# present and their versions. You should be able to identify the -# libraries and headers used and adjust your CFLAGS or remove incorrect -# versions. The output will show OpenSSL's internal version identifier -# and should look something like: - -# $ ./findssl.sh -# Searching for OpenSSL header files. -# 0x0090604fL /usr/include/openssl/opensslv.h -# 0x0090604fL /usr/local/ssl/include/openssl/opensslv.h -# -# Searching for OpenSSL shared library files. -# 0x0090602fL /lib/libcrypto.so.0.9.6b -# 0x0090602fL /lib/libcrypto.so.2 -# 0x0090581fL /usr/lib/libcrypto.so.0 -# 0x0090602fL /usr/lib/libcrypto.so -# 0x0090581fL /usr/lib/libcrypto.so.0.9.5a -# 0x0090600fL /usr/lib/libcrypto.so.0.9.6 -# 0x0090600fL /usr/lib/libcrypto.so.1 -# -# Searching for OpenSSL static library files. -# 0x0090602fL /usr/lib/libcrypto.a -# 0x0090604fL /usr/local/ssl/lib/libcrypto.a -# -# In this example, I gave configure no extra flags, so it's picking up -# the OpenSSL header from /usr/include/openssl (90604f) and the library -# from /usr/lib/ (90602f). - -# -# Adjust these to suit your compiler. -# You may also need to set the *LIB*PATH environment variables if -# DEFAULT_LIBPATH is not correct for your system. -# -CC=gcc -STATIC=-static - -# -# Set up conftest C source -# -rm -f findssl.log -cat >conftest.c <<EOD -#include <stdio.h> -int main(){printf("0x%08xL\n", SSLeay());} -EOD - -# -# Set default library paths if not already set -# -DEFAULT_LIBPATH=/usr/lib:/usr/local/lib -LIBPATH=${LIBPATH:=$DEFAULT_LIBPATH} -LD_LIBRARY_PATH=${LD_LIBRARY_PATH:=$DEFAULT_LIBPATH} -LIBRARY_PATH=${LIBRARY_PATH:=$DEFAULT_LIBPATH} -export LIBPATH LD_LIBRARY_PATH LIBRARY_PATH - -# -# Search for OpenSSL headers and print versions -# -echo Searching for OpenSSL header files. -if [ -x "`which locate`" ] -then - headers=`locate opensslv.h` -else - headers=`find / -name opensslv.h -print 2>/dev/null` -fi - -for header in $headers -do - ver=`awk '/OPENSSL_VERSION_NUMBER/{printf \$3}' $header` - echo "$ver $header" -done -echo - -# -# Search for shared libraries. -# Relies on shared libraries looking like "libcrypto.s*" -# -echo Searching for OpenSSL shared library files. -if [ -x "`which locate`" ] -then - libraries=`locate libcrypto.s` -else - libraries=`find / -name 'libcrypto.s*' -print 2>/dev/null` -fi - -for lib in $libraries -do - (echo "Trying libcrypto $lib" >>findssl.log - dir=`dirname $lib` - LIBPATH="$dir:$LIBPATH" - LD_LIBRARY_PATH="$dir:$LIBPATH" - LIBRARY_PATH="$dir:$LIBPATH" - export LIBPATH LD_LIBRARY_PATH LIBRARY_PATH - ${CC} -o conftest conftest.c $lib 2>>findssl.log - if [ -x ./conftest ] - then - ver=`./conftest 2>/dev/null` - rm -f ./conftest - echo "$ver $lib" - fi) -done -echo - -# -# Search for static OpenSSL libraries and print versions -# -echo Searching for OpenSSL static library files. -if [ -x "`which locate`" ] -then - libraries=`locate libcrypto.a` -else - libraries=`find / -name libcrypto.a -print 2>/dev/null` -fi - -for lib in $libraries -do - libdir=`dirname $lib` - echo "Trying libcrypto $lib" >>findssl.log - ${CC} ${STATIC} -o conftest conftest.c -L${libdir} -lcrypto 2>>findssl.log - if [ -x ./conftest ] - then - ver=`./conftest 2>/dev/null` - rm -f ./conftest - echo "$ver $lib" - fi -done - -# -# Clean up -# -rm -f conftest.c diff --git a/crypto/openssh/contrib/gnome-ssh-askpass1.c b/crypto/openssh/contrib/gnome-ssh-askpass1.c deleted file mode 100644 index 4d51032..0000000 --- a/crypto/openssh/contrib/gnome-ssh-askpass1.c +++ /dev/null @@ -1,171 +0,0 @@ -/* - * Copyright (c) 2000-2002 Damien Miller. All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * - * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR - * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES - * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. - * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, - * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, - * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY - * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF - * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - */ - -/* - * This is a simple GNOME SSH passphrase grabber. To use it, set the - * environment variable SSH_ASKPASS to point to the location of - * gnome-ssh-askpass before calling "ssh-add < /dev/null". - * - * There is only two run-time options: if you set the environment variable - * "GNOME_SSH_ASKPASS_GRAB_SERVER=true" then gnome-ssh-askpass will grab - * the X server. If you set "GNOME_SSH_ASKPASS_GRAB_POINTER=true", then the - * pointer will be grabbed too. These may have some benefit to security if - * you don't trust your X server. We grab the keyboard always. - */ - -/* - * Compile with: - * - * cc `gnome-config --cflags gnome gnomeui` \ - * gnome-ssh-askpass1.c -o gnome-ssh-askpass \ - * `gnome-config --libs gnome gnomeui` - * - */ - -#include <stdlib.h> -#include <stdio.h> -#include <string.h> -#include <gnome.h> -#include <X11/Xlib.h> -#include <gdk/gdkx.h> - -void -report_failed_grab (void) -{ - GtkWidget *err; - - err = gnome_message_box_new("Could not grab keyboard or mouse.\n" - "A malicious client may be eavesdropping on your session.", - GNOME_MESSAGE_BOX_ERROR, "EXIT", NULL); - gtk_window_set_position(GTK_WINDOW(err), GTK_WIN_POS_CENTER); - gtk_object_set(GTK_OBJECT(err), "type", GTK_WINDOW_POPUP, NULL); - - gnome_dialog_run_and_close(GNOME_DIALOG(err)); -} - -int -passphrase_dialog(char *message) -{ - char *passphrase; - char **messages; - int result, i, grab_server, grab_pointer; - GtkWidget *dialog, *entry, *label; - - grab_server = (getenv("GNOME_SSH_ASKPASS_GRAB_SERVER") != NULL); - grab_pointer = (getenv("GNOME_SSH_ASKPASS_GRAB_POINTER") != NULL); - - dialog = gnome_dialog_new("OpenSSH", GNOME_STOCK_BUTTON_OK, - GNOME_STOCK_BUTTON_CANCEL, NULL); - - messages = g_strsplit(message, "\\n", 0); - if (messages) - for(i = 0; messages[i]; i++) { - label = gtk_label_new(messages[i]); - gtk_box_pack_start(GTK_BOX(GNOME_DIALOG(dialog)->vbox), - label, FALSE, FALSE, 0); - } - - entry = gtk_entry_new(); - gtk_box_pack_start(GTK_BOX(GNOME_DIALOG(dialog)->vbox), entry, FALSE, - FALSE, 0); - gtk_entry_set_visibility(GTK_ENTRY(entry), FALSE); - gtk_widget_grab_focus(entry); - - /* Center window and prepare for grab */ - gtk_object_set(GTK_OBJECT(dialog), "type", GTK_WINDOW_POPUP, NULL); - gnome_dialog_set_default(GNOME_DIALOG(dialog), 0); - gtk_window_set_position (GTK_WINDOW(dialog), GTK_WIN_POS_CENTER); - gtk_window_set_policy(GTK_WINDOW(dialog), FALSE, FALSE, TRUE); - gnome_dialog_close_hides(GNOME_DIALOG(dialog), TRUE); - gtk_container_set_border_width(GTK_CONTAINER(GNOME_DIALOG(dialog)->vbox), - GNOME_PAD); - gtk_widget_show_all(dialog); - - /* Grab focus */ - if (grab_server) - XGrabServer(GDK_DISPLAY()); - if (grab_pointer && gdk_pointer_grab(dialog->window, TRUE, 0, - NULL, NULL, GDK_CURRENT_TIME)) - goto nograb; - if (gdk_keyboard_grab(dialog->window, FALSE, GDK_CURRENT_TIME)) - goto nograbkb; - - /* Make <enter> close dialog */ - gnome_dialog_editable_enters(GNOME_DIALOG(dialog), GTK_EDITABLE(entry)); - - /* Run dialog */ - result = gnome_dialog_run(GNOME_DIALOG(dialog)); - - /* Ungrab */ - if (grab_server) - XUngrabServer(GDK_DISPLAY()); - if (grab_pointer) - gdk_pointer_ungrab(GDK_CURRENT_TIME); - gdk_keyboard_ungrab(GDK_CURRENT_TIME); - gdk_flush(); - - /* Report passphrase if user selected OK */ - passphrase = gtk_entry_get_text(GTK_ENTRY(entry)); - if (result == 0) - puts(passphrase); - - /* Zero passphrase in memory */ - memset(passphrase, '\0', strlen(passphrase)); - gtk_entry_set_text(GTK_ENTRY(entry), passphrase); - - gnome_dialog_close(GNOME_DIALOG(dialog)); - return (result == 0 ? 0 : -1); - - /* At least one grab failed - ungrab what we got, and report - the failure to the user. Note that XGrabServer() cannot - fail. */ - nograbkb: - gdk_pointer_ungrab(GDK_CURRENT_TIME); - nograb: - if (grab_server) - XUngrabServer(GDK_DISPLAY()); - gnome_dialog_close(GNOME_DIALOG(dialog)); - - report_failed_grab(); - return (-1); -} - -int -main(int argc, char **argv) -{ - char *message; - int result; - - gnome_init("GNOME ssh-askpass", "0.1", argc, argv); - - if (argc == 2) - message = argv[1]; - else - message = "Enter your OpenSSH passphrase:"; - - setvbuf(stdout, 0, _IONBF, 0); - result = passphrase_dialog(message); - - return (result); -} diff --git a/crypto/openssh/contrib/gnome-ssh-askpass2.c b/crypto/openssh/contrib/gnome-ssh-askpass2.c deleted file mode 100644 index 0ce8dae..0000000 --- a/crypto/openssh/contrib/gnome-ssh-askpass2.c +++ /dev/null @@ -1,220 +0,0 @@ -/* - * Copyright (c) 2000-2002 Damien Miller. All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * - * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR - * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES - * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. - * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, - * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, - * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY - * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF - * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - */ - -/* GTK2 support by Nalin Dahyabhai <nalin@redhat.com> */ - -/* - * This is a simple GNOME SSH passphrase grabber. To use it, set the - * environment variable SSH_ASKPASS to point to the location of - * gnome-ssh-askpass before calling "ssh-add < /dev/null". - * - * There is only two run-time options: if you set the environment variable - * "GNOME_SSH_ASKPASS_GRAB_SERVER=true" then gnome-ssh-askpass will grab - * the X server. If you set "GNOME_SSH_ASKPASS_GRAB_POINTER=true", then the - * pointer will be grabbed too. These may have some benefit to security if - * you don't trust your X server. We grab the keyboard always. - */ - -#define GRAB_TRIES 16 -#define GRAB_WAIT 250 /* milliseconds */ - -/* - * Compile with: - * - * cc -Wall `pkg-config --cflags gtk+-2.0` \ - * gnome-ssh-askpass2.c -o gnome-ssh-askpass \ - * `pkg-config --libs gtk+-2.0` - * - */ - -#include <stdlib.h> -#include <stdio.h> -#include <string.h> -#include <unistd.h> -#include <X11/Xlib.h> -#include <gtk/gtk.h> -#include <gdk/gdkx.h> - -static void -report_failed_grab (const char *what) -{ - GtkWidget *err; - - err = gtk_message_dialog_new(NULL, 0, - GTK_MESSAGE_ERROR, - GTK_BUTTONS_CLOSE, - "Could not grab %s. " - "A malicious client may be eavesdropping " - "on your session.", what); - gtk_window_set_position(GTK_WINDOW(err), GTK_WIN_POS_CENTER); - gtk_label_set_line_wrap(GTK_LABEL((GTK_MESSAGE_DIALOG(err))->label), - TRUE); - - gtk_dialog_run(GTK_DIALOG(err)); - - gtk_widget_destroy(err); -} - -static void -ok_dialog(GtkWidget *entry, gpointer dialog) -{ - g_return_if_fail(GTK_IS_DIALOG(dialog)); - gtk_dialog_response(GTK_DIALOG(dialog), GTK_RESPONSE_OK); -} - -static int -passphrase_dialog(char *message) -{ - const char *failed; - char *passphrase, *local; - int result, grab_tries, grab_server, grab_pointer; - GtkWidget *dialog, *entry; - GdkGrabStatus status; - - grab_server = (getenv("GNOME_SSH_ASKPASS_GRAB_SERVER") != NULL); - grab_pointer = (getenv("GNOME_SSH_ASKPASS_GRAB_POINTER") != NULL); - grab_tries = 0; - - dialog = gtk_message_dialog_new(NULL, 0, - GTK_MESSAGE_QUESTION, - GTK_BUTTONS_OK_CANCEL, - "%s", - message); - - entry = gtk_entry_new(); - gtk_box_pack_start(GTK_BOX(GTK_DIALOG(dialog)->vbox), entry, FALSE, - FALSE, 0); - gtk_entry_set_visibility(GTK_ENTRY(entry), FALSE); - gtk_widget_grab_focus(entry); - gtk_widget_show(entry); - - gtk_window_set_title(GTK_WINDOW(dialog), "OpenSSH"); - gtk_window_set_position (GTK_WINDOW(dialog), GTK_WIN_POS_CENTER); - gtk_label_set_line_wrap(GTK_LABEL((GTK_MESSAGE_DIALOG(dialog))->label), - TRUE); - - /* Make <enter> close dialog */ - gtk_dialog_set_default_response(GTK_DIALOG(dialog), GTK_RESPONSE_OK); - g_signal_connect(G_OBJECT(entry), "activate", - G_CALLBACK(ok_dialog), dialog); - - /* Grab focus */ - gtk_widget_show_now(dialog); - if (grab_pointer) { - for(;;) { - status = gdk_pointer_grab( - (GTK_WIDGET(dialog))->window, TRUE, 0, NULL, - NULL, GDK_CURRENT_TIME); - if (status == GDK_GRAB_SUCCESS) - break; - usleep(GRAB_WAIT * 1000); - if (++grab_tries > GRAB_TRIES) { - failed = "mouse"; - goto nograb; - } - } - } - for(;;) { - status = gdk_keyboard_grab((GTK_WIDGET(dialog))->window, - FALSE, GDK_CURRENT_TIME); - if (status == GDK_GRAB_SUCCESS) - break; - usleep(GRAB_WAIT * 1000); - if (++grab_tries > GRAB_TRIES) { - failed = "keyboard"; - goto nograbkb; - } - } - if (grab_server) { - gdk_x11_grab_server(); - } - - result = gtk_dialog_run(GTK_DIALOG(dialog)); - - /* Ungrab */ - if (grab_server) - XUngrabServer(GDK_DISPLAY()); - if (grab_pointer) - gdk_pointer_ungrab(GDK_CURRENT_TIME); - gdk_keyboard_ungrab(GDK_CURRENT_TIME); - gdk_flush(); - - /* Report passphrase if user selected OK */ - passphrase = g_strdup(gtk_entry_get_text(GTK_ENTRY(entry))); - if (result == GTK_RESPONSE_OK) { - local = g_locale_from_utf8(passphrase, strlen(passphrase), - NULL, NULL, NULL); - if (local != NULL) { - puts(local); - memset(local, '\0', strlen(local)); - g_free(local); - } else { - puts(passphrase); - } - } - - /* Zero passphrase in memory */ - memset(passphrase, '\b', strlen(passphrase)); - gtk_entry_set_text(GTK_ENTRY(entry), passphrase); - memset(passphrase, '\0', strlen(passphrase)); - g_free(passphrase); - - gtk_widget_destroy(dialog); - return (result == GTK_RESPONSE_OK ? 0 : -1); - - /* At least one grab failed - ungrab what we got, and report - the failure to the user. Note that XGrabServer() cannot - fail. */ - nograbkb: - gdk_pointer_ungrab(GDK_CURRENT_TIME); - nograb: - if (grab_server) - XUngrabServer(GDK_DISPLAY()); - gtk_widget_destroy(dialog); - - report_failed_grab(failed); - - return (-1); -} - -int -main(int argc, char **argv) -{ - char *message; - int result; - - gtk_init(&argc, &argv); - - if (argc > 1) { - message = g_strjoinv(" ", argv + 1); - } else { - message = g_strdup("Enter your OpenSSH passphrase:"); - } - - setvbuf(stdout, 0, _IONBF, 0); - result = passphrase_dialog(message); - g_free(message); - - return (result); -} diff --git a/crypto/openssh/contrib/hpux/README b/crypto/openssh/contrib/hpux/README deleted file mode 100644 index f8bfa84..0000000 --- a/crypto/openssh/contrib/hpux/README +++ /dev/null @@ -1,45 +0,0 @@ -README for OpenSSH HP-UX contrib files -Kevin Steves <stevesk@pobox.com> - -sshd: configuration file for sshd.rc -sshd.rc: SSH startup script -egd: configuration file for egd.rc -egd.rc: EGD (entropy gathering daemon) startup script - -To install: - -sshd.rc: - -o Verify paths in sshd.rc match your local installation - (WHAT_PATH and WHAT_PID) -o Customize sshd if needed (SSHD_ARGS) -o Install: - - # cp sshd /etc/rc.config.d - # chmod 444 /etc/rc.config.d/sshd - # cp sshd.rc /sbin/init.d - # chmod 555 /sbin/init.d/sshd.rc - # ln -s /sbin/init.d/sshd.rc /sbin/rc1.d/K100sshd - # ln -s /sbin/init.d/sshd.rc /sbin/rc2.d/S900sshd - -egd.rc: - -o Verify egd.pl path in egd.rc matches your local installation - (WHAT_PATH) -o Customize egd if needed (EGD_ARGS and EGD_LOG) -o Add pseudo account: - - # groupadd egd - # useradd -g egd egd - # mkdir -p /etc/opt/egd - # chown egd:egd /etc/opt/egd - # chmod 711 /etc/opt/egd - -o Install: - - # cp egd /etc/rc.config.d - # chmod 444 /etc/rc.config.d/egd - # cp egd.rc /sbin/init.d - # chmod 555 /sbin/init.d/egd.rc - # ln -s /sbin/init.d/egd.rc /sbin/rc1.d/K600egd - # ln -s /sbin/init.d/egd.rc /sbin/rc2.d/S400egd diff --git a/crypto/openssh/contrib/hpux/egd b/crypto/openssh/contrib/hpux/egd deleted file mode 100644 index 21af0bd..0000000 --- a/crypto/openssh/contrib/hpux/egd +++ /dev/null @@ -1,15 +0,0 @@ -# EGD_START: Set to 1 to start entropy gathering daemon -# EGD_ARGS: Command line arguments to pass to egd -# EGD_LOG: EGD stdout and stderr log file (default /etc/opt/egd/egd.log) -# -# To configure the egd environment: - -# groupadd egd -# useradd -g egd egd -# mkdir -p /etc/opt/egd -# chown egd:egd /etc/opt/egd -# chmod 711 /etc/opt/egd - -EGD_START=1 -EGD_ARGS='/etc/opt/egd/entropy' -EGD_LOG= diff --git a/crypto/openssh/contrib/hpux/egd.rc b/crypto/openssh/contrib/hpux/egd.rc deleted file mode 100755 index 919dea7..0000000 --- a/crypto/openssh/contrib/hpux/egd.rc +++ /dev/null @@ -1,98 +0,0 @@ -#!/sbin/sh - -# -# egd.rc: EGD start-up and shutdown script -# - -# Allowed exit values: -# 0 = success; causes "OK" to show up in checklist. -# 1 = failure; causes "FAIL" to show up in checklist. -# 2 = skip; causes "N/A" to show up in the checklist. -# Use this value if execution of this script is overridden -# by the use of a control variable, or if this script is not -# appropriate to execute for some other reason. -# 3 = reboot; causes the system to be rebooted after execution. - -# Input and output: -# stdin is redirected from /dev/null -# -# stdout and stderr are redirected to the /etc/rc.log file -# during checklist mode, or to the console in raw mode. - -umask 022 - -PATH=/usr/sbin:/usr/bin:/sbin -export PATH - -WHAT='EGD (entropy gathering daemon)' -WHAT_PATH=/opt/perl/bin/egd.pl -WHAT_CONFIG=/etc/rc.config.d/egd -WHAT_LOG=/etc/opt/egd/egd.log - -# NOTE: If your script executes in run state 0 or state 1, then /usr might -# not be available. Do not attempt to access commands or files in -# /usr unless your script executes in run state 2 or greater. Other -# file systems typically not mounted until run state 2 include /var -# and /opt. - -rval=0 - -# Check the exit value of a command run by this script. If non-zero, the -# exit code is echoed to the log file and the return value of this script -# is set to indicate failure. - -set_return() { - x=$? - if [ $x -ne 0 ]; then - echo "EXIT CODE: $x" - rval=1 # script FAILed - fi -} - -case $1 in -'start_msg') - echo "Starting $WHAT" - ;; - -'stop_msg') - echo "Stopping $WHAT" - ;; - -'start') - if [ -f $WHAT_CONFIG ] ; then - . $WHAT_CONFIG - else - echo "ERROR: $WHAT_CONFIG defaults file MISSING" - fi - - - if [ "$EGD_START" -eq 1 -a -x $WHAT_PATH ]; then - EGD_LOG=${EGD_LOG:-$WHAT_LOG} - su egd -c "nohup $WHAT_PATH $EGD_ARGS >$EGD_LOG 2>&1" && - echo $WHAT started - set_return - else - rval=2 - fi - ;; - -'stop') - pid=`ps -fuegd | awk '$1 == "egd" { print $2 }'` - if [ "X$pid" != "X" ]; then - if kill "$pid"; then - echo "$WHAT stopped" - else - rval=1 - echo "Unable to stop $WHAT" - fi - fi - set_return - ;; - -*) - echo "usage: $0 {start|stop|start_msg|stop_msg}" - rval=1 - ;; -esac - -exit $rval diff --git a/crypto/openssh/contrib/hpux/sshd b/crypto/openssh/contrib/hpux/sshd deleted file mode 100644 index 8eb5e92..0000000 --- a/crypto/openssh/contrib/hpux/sshd +++ /dev/null @@ -1,5 +0,0 @@ -# SSHD_START: Set to 1 to start SSH daemon -# SSHD_ARGS: Command line arguments to pass to sshd -# -SSHD_START=1 -SSHD_ARGS= diff --git a/crypto/openssh/contrib/hpux/sshd.rc b/crypto/openssh/contrib/hpux/sshd.rc deleted file mode 100755 index f9a1099..0000000 --- a/crypto/openssh/contrib/hpux/sshd.rc +++ /dev/null @@ -1,90 +0,0 @@ -#!/sbin/sh - -# -# sshd.rc: SSH daemon start-up and shutdown script -# - -# Allowed exit values: -# 0 = success; causes "OK" to show up in checklist. -# 1 = failure; causes "FAIL" to show up in checklist. -# 2 = skip; causes "N/A" to show up in the checklist. -# Use this value if execution of this script is overridden -# by the use of a control variable, or if this script is not -# appropriate to execute for some other reason. -# 3 = reboot; causes the system to be rebooted after execution. - -# Input and output: -# stdin is redirected from /dev/null -# -# stdout and stderr are redirected to the /etc/rc.log file -# during checklist mode, or to the console in raw mode. - -PATH=/usr/sbin:/usr/bin:/sbin -export PATH - -WHAT='OpenSSH' -WHAT_PATH=/opt/openssh/sbin/sshd -WHAT_PID=/var/run/sshd.pid -WHAT_CONFIG=/etc/rc.config.d/sshd - -# NOTE: If your script executes in run state 0 or state 1, then /usr might -# not be available. Do not attempt to access commands or files in -# /usr unless your script executes in run state 2 or greater. Other -# file systems typically not mounted until run state 2 include /var -# and /opt. - -rval=0 - -# Check the exit value of a command run by this script. If non-zero, the -# exit code is echoed to the log file and the return value of this script -# is set to indicate failure. - -set_return() { - x=$? - if [ $x -ne 0 ]; then - echo "EXIT CODE: $x" - rval=1 # script FAILed - fi -} - -case $1 in -'start_msg') - echo "Starting $WHAT" - ;; - -'stop_msg') - echo "Stopping $WHAT" - ;; - -'start') - if [ -f $WHAT_CONFIG ] ; then - . $WHAT_CONFIG - else - echo "ERROR: $WHAT_CONFIG defaults file MISSING" - fi - - if [ "$SSHD_START" -eq 1 -a -x "$WHAT_PATH" ]; then - $WHAT_PATH $SSHD_ARGS && echo "$WHAT started" - set_return - else - rval=2 - fi - ;; - -'stop') - if kill `cat $WHAT_PID`; then - echo "$WHAT stopped" - else - rval=1 - echo "Unable to stop $WHAT" - fi - set_return - ;; - -*) - echo "usage: $0 {start|stop|start_msg|stop_msg}" - rval=1 - ;; -esac - -exit $rval diff --git a/crypto/openssh/contrib/redhat/gnome-ssh-askpass.csh b/crypto/openssh/contrib/redhat/gnome-ssh-askpass.csh deleted file mode 100644 index dd77712..0000000 --- a/crypto/openssh/contrib/redhat/gnome-ssh-askpass.csh +++ /dev/null @@ -1 +0,0 @@ -setenv SSH_ASKPASS /usr/libexec/openssh/gnome-ssh-askpass diff --git a/crypto/openssh/contrib/redhat/gnome-ssh-askpass.sh b/crypto/openssh/contrib/redhat/gnome-ssh-askpass.sh deleted file mode 100644 index 355189f..0000000 --- a/crypto/openssh/contrib/redhat/gnome-ssh-askpass.sh +++ /dev/null @@ -1,2 +0,0 @@ -SSH_ASKPASS=/usr/libexec/openssh/gnome-ssh-askpass -export SSH_ASKPASS diff --git a/crypto/openssh/contrib/redhat/openssh.spec b/crypto/openssh/contrib/redhat/openssh.spec deleted file mode 100644 index b747009..0000000 --- a/crypto/openssh/contrib/redhat/openssh.spec +++ /dev/null @@ -1,804 +0,0 @@ -%define ver 3.8.1p1 -%define rel 1 - -# OpenSSH privilege separation requires a user & group ID -%define sshd_uid 74 -%define sshd_gid 74 - -# Version of ssh-askpass -%define aversion 1.2.4.1 - -# Do we want to disable building of x11-askpass? (1=yes 0=no) -%define no_x11_askpass 0 - -# Do we want to disable building of gnome-askpass? (1=yes 0=no) -%define no_gnome_askpass 0 - -# Do we want to link against a static libcrypto? (1=yes 0=no) -%define static_libcrypto 0 - -# Do we want smartcard support (1=yes 0=no) -%define scard 0 - -# Use GTK2 instead of GNOME in gnome-ssh-askpass -%define gtk2 1 - -# Is this build for RHL 6.x? -%define build6x 0 - -# Do we want kerberos5 support (1=yes 0=no) -%define kerberos5 1 - -# Reserve options to override askpass settings with: -# rpm -ba|--rebuild --define 'skip_xxx 1' -%{?skip_x11_askpass:%define no_x11_askpass 1} -%{?skip_gnome_askpass:%define no_gnome_askpass 1} - -# Add option to build without GTK2 for older platforms with only GTK+. -# RedHat <= 7.2 and Red Hat Advanced Server 2.1 are examples. -# rpm -ba|--rebuild --define 'no_gtk2 1' -%{?no_gtk2:%define gtk2 0} - -# Is this a build for RHL 6.x or earlier? -%{?build_6x:%define build6x 1} - -# If this is RHL 6.x, the default configuration has sysconfdir in /usr/etc. -%if %{build6x} -%define _sysconfdir /etc -%endif - -# Options for static OpenSSL link: -# rpm -ba|--rebuild --define "static_openssl 1" -%{?static_openssl:%define static_libcrypto 1} - -# Options for Smartcard support: (needs libsectok and openssl-engine) -# rpm -ba|--rebuild --define "smartcard 1" -%{?smartcard:%define scard 1} - -# Is this a build for the rescue CD (without PAM, with MD5)? (1=yes 0=no) -%define rescue 0 -%{?build_rescue:%define rescue 1} - -# Turn off some stuff for resuce builds -%if %{rescue} -%define kerberos5 0 -%endif - -Summary: The OpenSSH implementation of SSH protocol versions 1 and 2. -Name: openssh -Version: %{ver} -%if %{rescue} -Release: %{rel}rescue -%else -Release: %{rel} -%endif -URL: http://www.openssh.com/portable.html -Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz -Source1: http://www.pobox.com/~jmknoble/software/x11-ssh-askpass/x11-ssh-askpass-%{aversion}.tar.gz -License: BSD -Group: Applications/Internet -BuildRoot: %{_tmppath}/%{name}-%{version}-buildroot -Obsoletes: ssh -%if %{build6x} -PreReq: initscripts >= 5.00 -%else -PreReq: initscripts >= 5.20 -%endif -BuildPreReq: perl, openssl-devel, tcp_wrappers -BuildPreReq: /bin/login -%if ! %{build6x} -BuildPreReq: glibc-devel, pam -%else -BuildPreReq: /usr/include/security/pam_appl.h -%endif -%if ! %{no_x11_askpass} -BuildPreReq: XFree86-devel -%endif -%if ! %{no_gnome_askpass} -BuildPreReq: pkgconfig -%endif -%if %{kerberos5} -BuildPreReq: krb5-devel -BuildPreReq: krb5-libs -%endif - -%package clients -Summary: OpenSSH clients. -Requires: openssh = %{version}-%{release} -Group: Applications/Internet -Obsoletes: ssh-clients - -%package server -Summary: The OpenSSH server daemon. -Group: System Environment/Daemons -Obsoletes: ssh-server -PreReq: openssh = %{version}-%{release}, chkconfig >= 0.9 -%if ! %{build6x} -Requires: /etc/pam.d/system-auth -%endif - -%package askpass -Summary: A passphrase dialog for OpenSSH and X. -Group: Applications/Internet -Requires: openssh = %{version}-%{release} -Obsoletes: ssh-extras - -%package askpass-gnome -Summary: A passphrase dialog for OpenSSH, X, and GNOME. -Group: Applications/Internet -Requires: openssh = %{version}-%{release} -Obsoletes: ssh-extras - -%description -SSH (Secure SHell) is a program for logging into and executing -commands on a remote machine. SSH is intended to replace rlogin and -rsh, and to provide secure encrypted communications between two -untrusted hosts over an insecure network. X11 connections and -arbitrary TCP/IP ports can also be forwarded over the secure channel. - -OpenSSH is OpenBSD's version of the last free version of SSH, bringing -it up to date in terms of security and features, as well as removing -all patented algorithms to separate libraries. - -This package includes the core files necessary for both the OpenSSH -client and server. To make this package useful, you should also -install openssh-clients, openssh-server, or both. - -%description clients -OpenSSH is a free version of SSH (Secure SHell), a program for logging -into and executing commands on a remote machine. This package includes -the clients necessary to make encrypted connections to SSH servers. -You'll also need to install the openssh package on OpenSSH clients. - -%description server -OpenSSH is a free version of SSH (Secure SHell), a program for logging -into and executing commands on a remote machine. This package contains -the secure shell daemon (sshd). The sshd daemon allows SSH clients to -securely connect to your SSH server. You also need to have the openssh -package installed. - -%description askpass -OpenSSH is a free version of SSH (Secure SHell), a program for logging -into and executing commands on a remote machine. This package contains -an X11 passphrase dialog for OpenSSH. - -%description askpass-gnome -OpenSSH is a free version of SSH (Secure SHell), a program for logging -into and executing commands on a remote machine. This package contains -an X11 passphrase dialog for OpenSSH and the GNOME GUI desktop -environment. - -%prep - -%if ! %{no_x11_askpass} -%setup -q -a 1 -%else -%setup -q -%endif - -%build -%if %{rescue} -CFLAGS="$RPM_OPT_FLAGS -Os"; export CFLAGS -%endif - -%if %{kerberos5} -K5DIR=`rpm -ql krb5-devel | grep include/krb5.h | sed 's,\/include\/krb5.h,,'` -echo K5DIR=$K5DIR -%endif - -%configure \ - --sysconfdir=%{_sysconfdir}/ssh \ - --libexecdir=%{_libexecdir}/openssh \ - --datadir=%{_datadir}/openssh \ - --with-tcp-wrappers \ - --with-rsh=%{_bindir}/rsh \ - --with-default-path=/usr/local/bin:/bin:/usr/bin \ - --with-superuser-path=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin \ - --with-privsep-path=%{_var}/empty/sshd \ - --with-md5-passwords \ -%if %{scard} - --with-smartcard \ -%endif -%if %{rescue} - --without-pam \ -%else - --with-pam \ -%endif -%if %{kerberos5} - --with-kerberos5=$K5DIR \ -%endif - - -%if %{static_libcrypto} -perl -pi -e "s|-lcrypto|%{_libdir}/libcrypto.a|g" Makefile -%endif - -make - -%if ! %{no_x11_askpass} -pushd x11-ssh-askpass-%{aversion} -%configure --libexecdir=%{_libexecdir}/openssh -xmkmf -a -make -popd -%endif - -# Define a variable to toggle gnome1/gtk2 building. This is necessary -# because RPM doesn't handle nested %if statements. -%if %{gtk2} - gtk2=yes -%else - gtk2=no -%endif - -%if ! %{no_gnome_askpass} -pushd contrib -if [ $gtk2 = yes ] ; then - make gnome-ssh-askpass2 - mv gnome-ssh-askpass2 gnome-ssh-askpass -else - make gnome-ssh-askpass1 - mv gnome-ssh-askpass1 gnome-ssh-askpass -fi -popd -%endif - -%install -rm -rf $RPM_BUILD_ROOT -mkdir -p -m755 $RPM_BUILD_ROOT%{_sysconfdir}/ssh -mkdir -p -m755 $RPM_BUILD_ROOT%{_libexecdir}/openssh -mkdir -p -m755 $RPM_BUILD_ROOT%{_var}/empty/sshd - -make install DESTDIR=$RPM_BUILD_ROOT - -install -d $RPM_BUILD_ROOT/etc/pam.d/ -install -d $RPM_BUILD_ROOT/etc/rc.d/init.d -install -d $RPM_BUILD_ROOT%{_libexecdir}/openssh -%if %{build6x} -install -m644 contrib/redhat/sshd.pam.old $RPM_BUILD_ROOT/etc/pam.d/sshd -%else -install -m644 contrib/redhat/sshd.pam $RPM_BUILD_ROOT/etc/pam.d/sshd -%endif -install -m755 contrib/redhat/sshd.init $RPM_BUILD_ROOT/etc/rc.d/init.d/sshd - -%if ! %{no_x11_askpass} -install -s x11-ssh-askpass-%{aversion}/x11-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/x11-ssh-askpass -ln -s x11-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/ssh-askpass -%endif - -%if ! %{no_gnome_askpass} -install -s contrib/gnome-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/gnome-ssh-askpass -%endif - -%if ! %{scard} - rm -f $RPM_BUILD_ROOT/usr/share/openssh/Ssh.bin -%endif - -%if ! %{no_gnome_askpass} -install -m 755 -d $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/ -install -m 755 contrib/redhat/gnome-ssh-askpass.csh $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/ -install -m 755 contrib/redhat/gnome-ssh-askpass.sh $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/ -%endif - -perl -pi -e "s|$RPM_BUILD_ROOT||g" $RPM_BUILD_ROOT%{_mandir}/man*/* - -%clean -rm -rf $RPM_BUILD_ROOT - -%triggerun server -- ssh-server -if [ "$1" != 0 -a -r /var/run/sshd.pid ] ; then - touch /var/run/sshd.restart -fi - -%triggerun server -- openssh-server < 2.5.0p1 -# Count the number of HostKey and HostDsaKey statements we have. -gawk 'BEGIN {IGNORECASE=1} - /^hostkey/ || /^hostdsakey/ {sawhostkey = sawhostkey + 1} - END {exit sawhostkey}' /etc/ssh/sshd_config -# And if we only found one, we know the client was relying on the old default -# behavior, which loaded the the SSH2 DSA host key when HostDsaKey wasn't -# specified. Now that HostKey is used for both SSH1 and SSH2 keys, specifying -# one nullifies the default, which would have loaded both. -if [ $? -eq 1 ] ; then - echo HostKey /etc/ssh/ssh_host_rsa_key >> /etc/ssh/sshd_config - echo HostKey /etc/ssh/ssh_host_dsa_key >> /etc/ssh/sshd_config -fi - -%triggerpostun server -- ssh-server -if [ "$1" != 0 ] ; then - /sbin/chkconfig --add sshd - if test -f /var/run/sshd.restart ; then - rm -f /var/run/sshd.restart - /sbin/service sshd start > /dev/null 2>&1 || : - fi -fi - -%pre server -%{_sbindir}/groupadd -r -g %{sshd_gid} sshd 2>/dev/null || : -%{_sbindir}/useradd -d /var/empty/sshd -s /bin/false -u %{sshd_uid} \ - -g sshd -M -r sshd 2>/dev/null || : - -%post server -/sbin/chkconfig --add sshd - -%postun server -/sbin/service sshd condrestart > /dev/null 2>&1 || : - -%preun server -if [ "$1" = 0 ] -then - /sbin/service sshd stop > /dev/null 2>&1 || : - /sbin/chkconfig --del sshd -fi - -%files -%defattr(-,root,root) -%doc CREDITS ChangeLog INSTALL LICENCE OVERVIEW README* RFC* TODO WARNING* -%attr(0755,root,root) %{_bindir}/scp -%attr(0644,root,root) %{_mandir}/man1/scp.1* -%attr(0755,root,root) %dir %{_sysconfdir}/ssh -%attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/moduli -%if ! %{rescue} -%attr(0755,root,root) %{_bindir}/ssh-keygen -%attr(0644,root,root) %{_mandir}/man1/ssh-keygen.1* -%attr(0755,root,root) %dir %{_libexecdir}/openssh -%attr(4711,root,root) %{_libexecdir}/openssh/ssh-keysign -%attr(0644,root,root) %{_mandir}/man8/ssh-keysign.8* -%endif -%if %{scard} -%attr(0755,root,root) %dir %{_datadir}/openssh -%attr(0644,root,root) %{_datadir}/openssh/Ssh.bin -%endif - -%files clients -%defattr(-,root,root) -%attr(0755,root,root) %{_bindir}/ssh -%attr(0644,root,root) %{_mandir}/man1/ssh.1* -%attr(0644,root,root) %{_mandir}/man5/ssh_config.5* -%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ssh/ssh_config -%attr(-,root,root) %{_bindir}/slogin -%attr(-,root,root) %{_mandir}/man1/slogin.1* -%if ! %{rescue} -%attr(2755,root,nobody) %{_bindir}/ssh-agent -%attr(0755,root,root) %{_bindir}/ssh-add -%attr(0755,root,root) %{_bindir}/ssh-keyscan -%attr(0755,root,root) %{_bindir}/sftp -%attr(0644,root,root) %{_mandir}/man1/ssh-agent.1* -%attr(0644,root,root) %{_mandir}/man1/ssh-add.1* -%attr(0644,root,root) %{_mandir}/man1/ssh-keyscan.1* -%attr(0644,root,root) %{_mandir}/man1/sftp.1* -%endif - -%if ! %{rescue} -%files server -%defattr(-,root,root) -%dir %attr(0111,root,root) %{_var}/empty/sshd -%attr(0755,root,root) %{_sbindir}/sshd -%attr(0755,root,root) %{_libexecdir}/openssh/sftp-server -%attr(0644,root,root) %{_mandir}/man8/sshd.8* -%attr(0644,root,root) %{_mandir}/man5/sshd_config.5* -%attr(0644,root,root) %{_mandir}/man8/sftp-server.8* -%attr(0755,root,root) %dir %{_sysconfdir}/ssh -%attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/sshd_config -%attr(0600,root,root) %config(noreplace) /etc/pam.d/sshd -%attr(0755,root,root) %config /etc/rc.d/init.d/sshd -%endif - -%if ! %{no_x11_askpass} -%files askpass -%defattr(-,root,root) -%doc x11-ssh-askpass-%{aversion}/README -%doc x11-ssh-askpass-%{aversion}/ChangeLog -%doc x11-ssh-askpass-%{aversion}/SshAskpass*.ad -%attr(0755,root,root) %{_libexecdir}/openssh/ssh-askpass -%attr(0755,root,root) %{_libexecdir}/openssh/x11-ssh-askpass -%endif - -%if ! %{no_gnome_askpass} -%files askpass-gnome -%defattr(-,root,root) -%attr(0755,root,root) %config %{_sysconfdir}/profile.d/gnome-ssh-askpass.* -%attr(0755,root,root) %{_libexecdir}/openssh/gnome-ssh-askpass -%endif - -%changelog -* Mon Jun 2 2003 Damien Miller <djm@mindrot.org> -- Remove noip6 option. This may be controlled at run-time in client config - file using new AddressFamily directive - -* Mon May 12 2003 Damien Miller <djm@mindrot.org> -- Don't install profile.d scripts when not building with GNOME/GTK askpass - (patch from bet@rahul.net) - -* Wed Oct 01 2002 Damien Miller <djm@mindrot.org> -- Install ssh-agent setgid nobody to prevent ptrace() key theft attacks - -* Mon Sep 30 2002 Damien Miller <djm@mindrot.org> -- Use contrib/ Makefile for building askpass programs - -* Fri Jun 21 2002 Damien Miller <djm@mindrot.org> -- Merge in spec changes from seba@iq.pl (Sebastian Pachuta) -- Add new {ssh,sshd}_config.5 manpages -- Add new ssh-keysign program and remove setuid from ssh client - -* Fri May 10 2002 Damien Miller <djm@mindrot.org> -- Merge in spec changes from RedHat, reorgansie a little -- Add Privsep user, group and directory - -* Thu Mar 7 2002 Nalin Dahyabhai <nalin@redhat.com> 3.1p1-2 -- bump and grind (through the build system) - -* Thu Mar 7 2002 Nalin Dahyabhai <nalin@redhat.com> 3.1p1-1 -- require sharutils for building (mindrot #137) -- require db1-devel only when building for 6.x (#55105), which probably won't - work anyway (3.1 requires OpenSSL 0.9.6 to build), but what the heck -- require pam-devel by file (not by package name) again -- add Markus's patch to compile with OpenSSL 0.9.5a (from - http://bugzilla.mindrot.org/show_bug.cgi?id=141) and apply it if we're - building for 6.x - -* Thu Mar 7 2002 Nalin Dahyabhai <nalin@redhat.com> 3.1p1-0 -- update to 3.1p1 - -* Tue Mar 5 2002 Nalin Dahyabhai <nalin@redhat.com> SNAP-20020305 -- update to SNAP-20020305 -- drop debug patch, fixed upstream - -* Wed Feb 20 2002 Nalin Dahyabhai <nalin@redhat.com> SNAP-20020220 -- update to SNAP-20020220 for testing purposes (you've been warned, if there's - anything to be warned about, gss patches won't apply, I don't mind) - -* Wed Feb 13 2002 Nalin Dahyabhai <nalin@redhat.com> 3.0.2p1-3 -- add patches from Simon Wilkinson and Nicolas Williams for GSSAPI key - exchange, authentication, and named key support - -* Wed Jan 23 2002 Nalin Dahyabhai <nalin@redhat.com> 3.0.2p1-2 -- remove dependency on db1-devel, which has just been swallowed up whole - by gnome-libs-devel - -* Sun Dec 29 2001 Nalin Dahyabhai <nalin@redhat.com> -- adjust build dependencies so that build6x actually works right (fix - from Hugo van der Kooij) - -* Tue Dec 4 2001 Nalin Dahyabhai <nalin@redhat.com> 3.0.2p1-1 -- update to 3.0.2p1 - -* Fri Nov 16 2001 Nalin Dahyabhai <nalin@redhat.com> 3.0.1p1-1 -- update to 3.0.1p1 - -* Tue Nov 13 2001 Nalin Dahyabhai <nalin@redhat.com> -- update to current CVS (not for use in distribution) - -* Thu Nov 8 2001 Nalin Dahyabhai <nalin@redhat.com> 3.0p1-1 -- merge some of Damien Miller <djm@mindrot.org> changes from the upstream - 3.0p1 spec file and init script - -* Wed Nov 7 2001 Nalin Dahyabhai <nalin@redhat.com> -- update to 3.0p1 -- update to x11-ssh-askpass 1.2.4.1 -- change build dependency on a file from pam-devel to the pam-devel package -- replace primes with moduli - -* Thu Sep 27 2001 Nalin Dahyabhai <nalin@redhat.com> 2.9p2-9 -- incorporate fix from Markus Friedl's advisory for IP-based authorization bugs - -* Thu Sep 13 2001 Bernhard Rosenkraenzer <bero@redhat.com> 2.9p2-8 -- Merge changes to rescue build from current sysadmin survival cd - -* Thu Sep 6 2001 Nalin Dahyabhai <nalin@redhat.com> 2.9p2-7 -- fix scp's server's reporting of file sizes, and build with the proper - preprocessor define to get large-file capable open(), stat(), etc. - (sftp has been doing this correctly all along) (#51827) -- configure without --with-ipv4-default on RHL 7.x and newer (#45987,#52247) -- pull cvs patch to fix support for /etc/nologin for non-PAM logins (#47298) -- mark profile.d scriptlets as config files (#42337) -- refer to Jason Stone's mail for zsh workaround for exit-hanging quasi-bug -- change a couple of log() statements to debug() statements (#50751) -- pull cvs patch to add -t flag to sshd (#28611) -- clear fd_sets correctly (one bit per FD, not one byte per FD) (#43221) - -* Mon Aug 20 2001 Nalin Dahyabhai <nalin@redhat.com> 2.9p2-6 -- add db1-devel as a BuildPrerequisite (noted by Hans Ecke) - -* Thu Aug 16 2001 Nalin Dahyabhai <nalin@redhat.com> -- pull cvs patch to fix remote port forwarding with protocol 2 - -* Thu Aug 9 2001 Nalin Dahyabhai <nalin@redhat.com> -- pull cvs patch to add session initialization to no-pty sessions -- pull cvs patch to not cut off challengeresponse auth needlessly -- refuse to do X11 forwarding if xauth isn't there, handy if you enable - it by default on a system that doesn't have X installed (#49263) - -* Wed Aug 8 2001 Nalin Dahyabhai <nalin@redhat.com> -- don't apply patches to code we don't intend to build (spotted by Matt Galgoci) - -* Mon Aug 6 2001 Nalin Dahyabhai <nalin@redhat.com> -- pass OPTIONS correctly to initlog (#50151) - -* Wed Jul 25 2001 Nalin Dahyabhai <nalin@redhat.com> -- switch to x11-ssh-askpass 1.2.2 - -* Wed Jul 11 2001 Nalin Dahyabhai <nalin@redhat.com> -- rebuild in new environment - -* Mon Jun 25 2001 Nalin Dahyabhai <nalin@redhat.com> -- disable the gssapi patch - -* Mon Jun 18 2001 Nalin Dahyabhai <nalin@redhat.com> -- update to 2.9p2 -- refresh to a new version of the gssapi patch - -* Thu Jun 7 2001 Nalin Dahyabhai <nalin@redhat.com> -- change Copyright: BSD to License: BSD -- add Markus Friedl's unverified patch for the cookie file deletion problem - so that we can verify it -- drop patch to check if xauth is present (was folded into cookie patch) -- don't apply gssapi patches for the errata candidate -- clear supplemental groups list at startup - -* Fri May 25 2001 Nalin Dahyabhai <nalin@redhat.com> -- fix an error parsing the new default sshd_config -- add a fix from Markus Friedl (via openssh-unix-dev) for ssh-keygen not - dealing with comments right - -* Thu May 24 2001 Nalin Dahyabhai <nalin@redhat.com> -- add in Simon Wilkinson's GSSAPI patch to give it some testing in-house, - to be removed before the next beta cycle because it's a big departure - from the upstream version - -* Thu May 3 2001 Nalin Dahyabhai <nalin@redhat.com> -- finish marking strings in the init script for translation -- modify init script to source /etc/sysconfig/sshd and pass $OPTIONS to sshd - at startup (change merged from openssh.com init script, originally by - Pekka Savola) -- refuse to do X11 forwarding if xauth isn't there, handy if you enable - it by default on a system that doesn't have X installed - -* Wed May 2 2001 Nalin Dahyabhai <nalin@redhat.com> -- update to 2.9 -- drop various patches that came from or went upstream or to or from CVS - -* Wed Apr 18 2001 Nalin Dahyabhai <nalin@redhat.com> -- only require initscripts 5.00 on 6.2 (reported by Peter Bieringer) - -* Sun Apr 8 2001 Preston Brown <pbrown@redhat.com> -- remove explicit openssl requirement, fixes builddistro issue -- make initscript stop() function wait until sshd really dead to avoid - races in condrestart - -* Mon Apr 2 2001 Nalin Dahyabhai <nalin@redhat.com> -- mention that challengereponse supports PAM, so disabling password doesn't - limit users to pubkey and rsa auth (#34378) -- bypass the daemon() function in the init script and call initlog directly, - because daemon() won't start a daemon it detects is already running (like - open connections) -- require the version of openssl we had when we were built - -* Fri Mar 23 2001 Nalin Dahyabhai <nalin@redhat.com> -- make do_pam_setcred() smart enough to know when to establish creds and - when to reinitialize them -- add in a couple of other fixes from Damien for inclusion in the errata - -* Thu Mar 22 2001 Nalin Dahyabhai <nalin@redhat.com> -- update to 2.5.2p2 -- call setcred() again after initgroups, because the "creds" could actually - be group memberships - -* Tue Mar 20 2001 Nalin Dahyabhai <nalin@redhat.com> -- update to 2.5.2p1 (includes endianness fixes in the rijndael implementation) -- don't enable challenge-response by default until we find a way to not - have too many userauth requests (we may make up to six pubkey and up to - three password attempts as it is) -- remove build dependency on rsh to match openssh.com's packages more closely - -* Sat Mar 3 2001 Nalin Dahyabhai <nalin@redhat.com> -- remove dependency on openssl -- would need to be too precise - -* Fri Mar 2 2001 Nalin Dahyabhai <nalin@redhat.com> -- rebuild in new environment - -* Mon Feb 26 2001 Nalin Dahyabhai <nalin@redhat.com> -- Revert the patch to move pam_open_session. -- Init script and spec file changes from Pekka Savola. (#28750) -- Patch sftp to recognize '-o protocol' arguments. (#29540) - -* Thu Feb 22 2001 Nalin Dahyabhai <nalin@redhat.com> -- Chuck the closing patch. -- Add a trigger to add host keys for protocol 2 to the config file, now that - configuration file syntax requires us to specify it with HostKey if we - specify any other HostKey values, which we do. - -* Tue Feb 20 2001 Nalin Dahyabhai <nalin@redhat.com> -- Redo patch to move pam_open_session after the server setuid()s to the user. -- Rework the nopam patch to use be picked up by autoconf. - -* Mon Feb 19 2001 Nalin Dahyabhai <nalin@redhat.com> -- Update for 2.5.1p1. -- Add init script mods from Pekka Savola. -- Tweak the init script to match the CVS contrib script more closely. -- Redo patch to ssh-add to try to adding both identity and id_dsa to also try - adding id_rsa. - -* Fri Feb 16 2001 Nalin Dahyabhai <nalin@redhat.com> -- Update for 2.5.0p1. -- Use $RPM_OPT_FLAGS instead of -O when building gnome-ssh-askpass -- Resync with parts of Damien Miller's openssh.spec from CVS, including - update of x11 askpass to 1.2.0. -- Only require openssl (don't prereq) because we generate keys in the init - script now. - -* Tue Feb 13 2001 Nalin Dahyabhai <nalin@redhat.com> -- Don't open a PAM session until we've forked and become the user (#25690). -- Apply Andrew Bartlett's patch for letting pam_authenticate() know which - host the user is attempting a login from. -- Resync with parts of Damien Miller's openssh.spec from CVS. -- Don't expose KbdInt responses in debug messages (from CVS). -- Detect and handle errors in rsa_{public,private}_decrypt (from CVS). - -* Wed Feb 7 2001 Trond Eivind Glomsrxd <teg@redhat.com> -- i18n-tweak to initscript. - -* Tue Jan 23 2001 Nalin Dahyabhai <nalin@redhat.com> -- More gettextizing. -- Close all files after going into daemon mode (needs more testing). -- Extract patch from CVS to handle auth banners (in the client). -- Extract patch from CVS to handle compat weirdness. - -* Fri Jan 19 2001 Nalin Dahyabhai <nalin@redhat.com> -- Finish with the gettextizing. - -* Thu Jan 18 2001 Nalin Dahyabhai <nalin@redhat.com> -- Fix a bug in auth2-pam.c (#23877) -- Gettextize the init script. - -* Wed Dec 20 2000 Nalin Dahyabhai <nalin@redhat.com> -- Incorporate a switch for using PAM configs for 6.x, just in case. - -* Tue Dec 5 2000 Nalin Dahyabhai <nalin@redhat.com> -- Incorporate Bero's changes for a build specifically for rescue CDs. - -* Wed Nov 29 2000 Nalin Dahyabhai <nalin@redhat.com> -- Don't treat pam_setcred() failure as fatal unless pam_authenticate() has - succeeded, to allow public-key authentication after a failure with "none" - authentication. (#21268) - -* Tue Nov 28 2000 Nalin Dahyabhai <nalin@redhat.com> -- Update to x11-askpass 1.1.1. (#21301) -- Don't second-guess fixpaths, which causes paths to get fixed twice. (#21290) - -* Mon Nov 27 2000 Nalin Dahyabhai <nalin@redhat.com> -- Merge multiple PAM text messages into subsequent prompts when possible when - doing keyboard-interactive authentication. - -* Sun Nov 26 2000 Nalin Dahyabhai <nalin@redhat.com> -- Disable the built-in MD5 password support. We're using PAM. -- Take a crack at doing keyboard-interactive authentication with PAM, and - enable use of it in the default client configuration so that the client - will try it when the server disallows password authentication. -- Build with debugging flags. Build root policies strip all binaries anyway. - -* Tue Nov 21 2000 Nalin Dahyabhai <nalin@redhat.com> -- Use DESTDIR instead of %%makeinstall. -- Remove /usr/X11R6/bin from the path-fixing patch. - -* Mon Nov 20 2000 Nalin Dahyabhai <nalin@redhat.com> -- Add the primes file from the latest snapshot to the main package (#20884). -- Add the dev package to the prereq list (#19984). -- Remove the default path and mimic login's behavior in the server itself. - -* Fri Nov 17 2000 Nalin Dahyabhai <nalin@redhat.com> -- Resync with conditional options in Damien Miller's .spec file for an errata. -- Change libexecdir from %%{_libexecdir}/ssh to %%{_libexecdir}/openssh. - -* Tue Nov 7 2000 Nalin Dahyabhai <nalin@redhat.com> -- Update to OpenSSH 2.3.0p1. -- Update to x11-askpass 1.1.0. -- Enable keyboard-interactive authentication. - -* Mon Oct 30 2000 Nalin Dahyabhai <nalin@redhat.com> -- Update to ssh-askpass-x11 1.0.3. -- Change authentication related messages to be private (#19966). - -* Tue Oct 10 2000 Nalin Dahyabhai <nalin@redhat.com> -- Patch ssh-keygen to be able to list signatures for DSA public key files - it generates. - -* Thu Oct 5 2000 Nalin Dahyabhai <nalin@redhat.com> -- Add BuildPreReq on /usr/include/security/pam_appl.h to be sure we always - build PAM authentication in. -- Try setting SSH_ASKPASS if gnome-ssh-askpass is installed. -- Clean out no-longer-used patches. -- Patch ssh-add to try to add both identity and id_dsa, and to error only - when neither exists. - -* Mon Oct 2 2000 Nalin Dahyabhai <nalin@redhat.com> -- Update x11-askpass to 1.0.2. (#17835) -- Add BuildPreReqs for /bin/login and /usr/bin/rsh so that configure will - always find them in the right place. (#17909) -- Set the default path to be the same as the one supplied by /bin/login, but - add /usr/X11R6/bin. (#17909) -- Try to handle obsoletion of ssh-server more cleanly. Package names - are different, but init script name isn't. (#17865) - -* Wed Sep 6 2000 Nalin Dahyabhai <nalin@redhat.com> -- Update to 2.2.0p1. (#17835) -- Tweak the init script to allow proper restarting. (#18023) - -* Wed Aug 23 2000 Nalin Dahyabhai <nalin@redhat.com> -- Update to 20000823 snapshot. -- Change subpackage requirements from %%{version} to %%{version}-%%{release} -- Back out the pipe patch. - -* Mon Jul 17 2000 Nalin Dahyabhai <nalin@redhat.com> -- Update to 2.1.1p4, which includes fixes for config file parsing problems. -- Move the init script back. -- Add Damien's quick fix for wackiness. - -* Wed Jul 12 2000 Nalin Dahyabhai <nalin@redhat.com> -- Update to 2.1.1p3, which includes fixes for X11 forwarding and strtok(). - -* Thu Jul 6 2000 Nalin Dahyabhai <nalin@redhat.com> -- Move condrestart to server postun. -- Move key generation to init script. -- Actually use the right patch for moving the key generation to the init script. -- Clean up the init script a bit. - -* Wed Jul 5 2000 Nalin Dahyabhai <nalin@redhat.com> -- Fix X11 forwarding, from mail post by Chan Shih-Ping Richard. - -* Sun Jul 2 2000 Nalin Dahyabhai <nalin@redhat.com> -- Update to 2.1.1p2. -- Use of strtok() considered harmful. - -* Sat Jul 1 2000 Nalin Dahyabhai <nalin@redhat.com> -- Get the build root out of the man pages. - -* Thu Jun 29 2000 Nalin Dahyabhai <nalin@redhat.com> -- Add and use condrestart support in the init script. -- Add newer initscripts as a prereq. - -* Tue Jun 27 2000 Nalin Dahyabhai <nalin@redhat.com> -- Build in new environment (release 2) -- Move -clients subpackage to Applications/Internet group - -* Fri Jun 9 2000 Nalin Dahyabhai <nalin@redhat.com> -- Update to 2.2.1p1 - -* Sat Jun 3 2000 Nalin Dahyabhai <nalin@redhat.com> -- Patch to build with neither RSA nor RSAref. -- Miscellaneous FHS-compliance tweaks. -- Fix for possibly-compressed man pages. - -* Wed Mar 15 2000 Damien Miller <djm@ibs.com.au> -- Updated for new location -- Updated for new gnome-ssh-askpass build - -* Sun Dec 26 1999 Damien Miller <djm@mindrot.org> -- Added Jim Knoble's <jmknoble@pobox.com> askpass - -* Mon Nov 15 1999 Damien Miller <djm@mindrot.org> -- Split subpackages further based on patch from jim knoble <jmknoble@pobox.com> - -* Sat Nov 13 1999 Damien Miller <djm@mindrot.org> -- Added 'Obsoletes' directives - -* Tue Nov 09 1999 Damien Miller <djm@ibs.com.au> -- Use make install -- Subpackages - -* Mon Nov 08 1999 Damien Miller <djm@ibs.com.au> -- Added links for slogin -- Fixed perms on manpages - -* Sat Oct 30 1999 Damien Miller <djm@ibs.com.au> -- Renamed init script - -* Fri Oct 29 1999 Damien Miller <djm@ibs.com.au> -- Back to old binary names - -* Thu Oct 28 1999 Damien Miller <djm@ibs.com.au> -- Use autoconf -- New binary names - -* Wed Oct 27 1999 Damien Miller <djm@ibs.com.au> -- Initial RPMification, based on Jan "Yenya" Kasprzak's <kas@fi.muni.cz> spec. diff --git a/crypto/openssh/contrib/redhat/sshd.init b/crypto/openssh/contrib/redhat/sshd.init deleted file mode 100755 index 4ee8630..0000000 --- a/crypto/openssh/contrib/redhat/sshd.init +++ /dev/null @@ -1,154 +0,0 @@ -#!/bin/bash -# -# Init file for OpenSSH server daemon -# -# chkconfig: 2345 55 25 -# description: OpenSSH server daemon -# -# processname: sshd -# config: /etc/ssh/ssh_host_key -# config: /etc/ssh/ssh_host_key.pub -# config: /etc/ssh/ssh_random_seed -# config: /etc/ssh/sshd_config -# pidfile: /var/run/sshd.pid - -# source function library -. /etc/rc.d/init.d/functions - -# pull in sysconfig settings -[ -f /etc/sysconfig/sshd ] && . /etc/sysconfig/sshd - -RETVAL=0 -prog="sshd" - -# Some functions to make the below more readable -KEYGEN=/usr/bin/ssh-keygen -SSHD=/usr/sbin/sshd -RSA1_KEY=/etc/ssh/ssh_host_key -RSA_KEY=/etc/ssh/ssh_host_rsa_key -DSA_KEY=/etc/ssh/ssh_host_dsa_key -PID_FILE=/var/run/sshd.pid - -do_rsa1_keygen() { - if [ ! -s $RSA1_KEY ]; then - echo -n $"Generating SSH1 RSA host key: " - if $KEYGEN -q -t rsa1 -f $RSA1_KEY -C '' -N '' >&/dev/null; then - chmod 600 $RSA1_KEY - chmod 644 $RSA1_KEY.pub - success $"RSA1 key generation" - echo - else - failure $"RSA1 key generation" - echo - exit 1 - fi - fi -} - -do_rsa_keygen() { - if [ ! -s $RSA_KEY ]; then - echo -n $"Generating SSH2 RSA host key: " - if $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >&/dev/null; then - chmod 600 $RSA_KEY - chmod 644 $RSA_KEY.pub - success $"RSA key generation" - echo - else - failure $"RSA key generation" - echo - exit 1 - fi - fi -} - -do_dsa_keygen() { - if [ ! -s $DSA_KEY ]; then - echo -n $"Generating SSH2 DSA host key: " - if $KEYGEN -q -t dsa -f $DSA_KEY -C '' -N '' >&/dev/null; then - chmod 600 $DSA_KEY - chmod 644 $DSA_KEY.pub - success $"DSA key generation" - echo - else - failure $"DSA key generation" - echo - exit 1 - fi - fi -} - -do_restart_sanity_check() -{ - $SSHD -t - RETVAL=$? - if [ ! "$RETVAL" = 0 ]; then - failure $"Configuration file or keys are invalid" - echo - fi -} - -start() -{ - # Create keys if necessary - do_rsa1_keygen - do_rsa_keygen - do_dsa_keygen - - echo -n $"Starting $prog:" - initlog -c "$SSHD $OPTIONS" && success || failure - RETVAL=$? - [ "$RETVAL" = 0 ] && touch /var/lock/subsys/sshd - echo -} - -stop() -{ - echo -n $"Stopping $prog:" - killproc $SSHD -TERM - RETVAL=$? - [ "$RETVAL" = 0 ] && rm -f /var/lock/subsys/sshd - echo -} - -reload() -{ - echo -n $"Reloading $prog:" - killproc $SSHD -HUP - RETVAL=$? - echo -} - -case "$1" in - start) - start - ;; - stop) - stop - ;; - restart) - stop - start - ;; - reload) - reload - ;; - condrestart) - if [ -f /var/lock/subsys/sshd ] ; then - do_restart_sanity_check - if [ "$RETVAL" = 0 ] ; then - stop - # avoid race - sleep 3 - start - fi - fi - ;; - status) - status $SSHD - RETVAL=$? - ;; - *) - echo $"Usage: $0 {start|stop|restart|reload|condrestart|status}" - RETVAL=1 -esac -exit $RETVAL diff --git a/crypto/openssh/contrib/redhat/sshd.pam b/crypto/openssh/contrib/redhat/sshd.pam deleted file mode 100644 index 24f3b46..0000000 --- a/crypto/openssh/contrib/redhat/sshd.pam +++ /dev/null @@ -1,8 +0,0 @@ -#%PAM-1.0 -auth required pam_stack.so service=system-auth -auth required pam_nologin.so -account required pam_stack.so service=system-auth -password required pam_stack.so service=system-auth -session required pam_stack.so service=system-auth -session required pam_limits.so -session optional pam_console.so diff --git a/crypto/openssh/contrib/solaris/README b/crypto/openssh/contrib/solaris/README deleted file mode 100755 index eb4c590..0000000 --- a/crypto/openssh/contrib/solaris/README +++ /dev/null @@ -1,24 +0,0 @@ -The following is a new package build script for Solaris. This is being -introduced into OpenSSH 3.0 and above in hopes of simplifying the build -process. As of 3.1p2 the script should work on all platforms that have -SVR4 style package tools. - -The build process is called a 'dummy install'.. Which means the software does -a "make install-nokeys DESTDIR=[fakeroot]". This way all manpages should -be handled correctly and key are defered until the first time the sshd -is started. - -Directions: - -1. make -F Makefile.in distprep (Only if you are getting from the CVS tree) -2. ./configure --with-pam [..any other options you want..] -3. look at the top of contrib/solaris/buildpkg.sh for the configurable options. -4. ./contrib/solaris/buildpkg.sh - -If all goes well you should have a solaris package ready to be installed. - -If you have any problems with this script please post them to -openssh-unix-dev@mindrot.org and I will try to assist you as best as I can. - -- Ben Lindstrom - diff --git a/crypto/openssh/contrib/solaris/buildpkg.sh b/crypto/openssh/contrib/solaris/buildpkg.sh deleted file mode 100755 index 29d0963..0000000 --- a/crypto/openssh/contrib/solaris/buildpkg.sh +++ /dev/null @@ -1,386 +0,0 @@ -#!/bin/sh -# -# Fake Root Solaris/SVR4/SVR5 Build System - Prototype -# -# The following code has been provide under Public Domain License. I really -# don't care what you use it for. Just as long as you don't complain to me -# nor my employer if you break it. - Ben Lindstrom (mouring@eviladmin.org) -# -umask 022 -# -# Options for building the package -# You can create a config.local with your customized options -# -# uncommenting TEST_DIR and using -# configure --prefix=/var/tmp --with-privsep-path=/var/tmp/empty -# and -# PKGNAME=tOpenSSH should allow testing a package without interfering -# with a real OpenSSH package on a system. This is not needed on systems -# that support the -R option to pkgadd. -#TEST_DIR=/var/tmp # leave commented out for production build -PKGNAME=OpenSSH -SYSVINIT_NAME=opensshd -MAKE=${MAKE:="make"} -SSHDUID=67 # Default privsep uid -SSHDGID=67 # Default privsep gid -# uncomment these next three as needed -#PERMIT_ROOT_LOGIN=no -#X11_FORWARDING=yes -#USR_LOCAL_IS_SYMLINK=yes -# list of system directories we do NOT want to change owner/group/perms -# when installing our package -SYSTEM_DIR="/etc \ -/etc/init.d \ -/etc/rcS.d \ -/etc/rc0.d \ -/etc/rc1.d \ -/etc/rc2.d \ -/etc/opt \ -/opt \ -/opt/bin \ -/usr \ -/usr/bin \ -/usr/lib \ -/usr/sbin \ -/usr/share \ -/usr/share/man \ -/usr/share/man/man1 \ -/usr/share/man/man8 \ -/usr/local \ -/usr/local/bin \ -/usr/local/etc \ -/usr/local/libexec \ -/usr/local/man \ -/usr/local/man/man1 \ -/usr/local/man/man8 \ -/usr/local/sbin \ -/usr/local/share \ -/var \ -/var/opt \ -/var/run \ -/var/tmp \ -/tmp" - -# We may need to build as root so we make sure PATH is set up -# only set the path if it's not set already -[ -d /usr/local/bin ] && { - echo $PATH | grep ":/usr/local/bin" > /dev/null 2>&1 - [ $? -ne 0 ] && PATH=$PATH:/usr/local/bin -} -[ -d /usr/ccs/bin ] && { - echo $PATH | grep ":/usr/ccs/bin" > /dev/null 2>&1 - [ $? -ne 0 ] && PATH=$PATH:/usr/ccs/bin -} -export PATH -# - -[ -f Makefile ] || { - echo "Please run this script from your build directory" - exit 1 -} - -# we will look for config.local to override the above options -[ -s ./config.local ] && . ./config.local - -## Start by faking root install -echo "Faking root install..." -START=`pwd` -OPENSSHD_IN=`dirname $0`/opensshd.in -FAKE_ROOT=$START/package -[ -d $FAKE_ROOT ] && rm -fr $FAKE_ROOT -mkdir $FAKE_ROOT -${MAKE} install-nokeys DESTDIR=$FAKE_ROOT -if [ $? -gt 0 ] -then - echo "Fake root install failed, stopping." - exit 1 -fi - -## Fill in some details, like prefix and sysconfdir -for confvar in prefix exec_prefix bindir sbindir libexecdir datadir mandir sysconfdir piddir -do - eval $confvar=`grep "^$confvar=" Makefile | cut -d = -f 2` -done - - -## Collect value of privsep user -for confvar in SSH_PRIVSEP_USER -do - eval $confvar=`awk '/#define[ \t]'$confvar'/{print $3}' config.h` -done - -## Set privsep defaults if not defined -if [ -z "$SSH_PRIVSEP_USER" ] -then - SSH_PRIVSEP_USER=sshd -fi - -## Extract common info requires for the 'info' part of the package. -VERSION=`./ssh -V 2>&1 | sed -e 's/,.*//'` - -UNAME_S=`uname -s` -case ${UNAME_S} in - SunOS) UNAME_S=Solaris - ARCH=`uname -p` - RCS_D=yes - DEF_MSG="(default: n)" - ;; - *) ARCH=`uname -m` - DEF_MSG="\n" ;; -esac - -## Setup our run level stuff while we are at it. -mkdir -p $FAKE_ROOT${TEST_DIR}/etc/init.d - -## setup our initscript correctly -sed -e "s#%%configDir%%#${sysconfdir}#g" \ - -e "s#%%openSSHDir%%#$prefix#g" \ - -e "s#%%pidDir%%#${piddir}#g" \ - ${OPENSSHD_IN} > $FAKE_ROOT${TEST_DIR}/etc/init.d/${SYSVINIT_NAME} -chmod 744 $FAKE_ROOT${TEST_DIR}/etc/init.d/${SYSVINIT_NAME} - -[ "${PERMIT_ROOT_LOGIN}" = no ] && \ - perl -p -i -e "s/#PermitRootLogin yes/PermitRootLogin no/" \ - $FAKE_ROOT/${sysconfdir}/sshd_config -[ "${X11_FORWARDING}" = yes ] && \ - perl -p -i -e "s/#X11Forwarding no/X11Forwarding yes/" \ - $FAKE_ROOT/${sysconfdir}/sshd_config -# fix PrintMotd -perl -p -i -e "s/#PrintMotd yes/PrintMotd no/" \ - $FAKE_ROOT/${sysconfdir}/sshd_config - -# We don't want to overwrite config files on multiple installs -mv $FAKE_ROOT/${sysconfdir}/ssh_config $FAKE_ROOT/${sysconfdir}/ssh_config.default -mv $FAKE_ROOT/${sysconfdir}/sshd_config $FAKE_ROOT/${sysconfdir}/sshd_config.default -[ -f $FAKE_ROOT/${sysconfdir}/ssh_prng_cmds ] && \ -mv $FAKE_ROOT/${sysconfdir}/ssh_prng_cmds $FAKE_ROOT/${sysconfdir}/ssh_prng_cmds.default - -cd $FAKE_ROOT - -## Ok, this is outright wrong, but it will work. I'm tired of pkgmk -## whining. -for i in *; do - PROTO_ARGS="$PROTO_ARGS $i=/$i"; -done - -## Build info file -echo "Building pkginfo file..." -cat > pkginfo << _EOF -PKG=$PKGNAME -NAME="OpenSSH Portable for ${UNAME_S}" -DESC="Secure Shell remote access utility; replaces telnet and rlogin/rsh." -VENDOR="OpenSSH Portable Team - http://www.openssh.com/portable.html" -ARCH=$ARCH -VERSION=$VERSION -CATEGORY="Security,application" -BASEDIR=/ -CLASSES="none" -_EOF - -## Build preinstall file -echo "Building preinstall file..." -cat > preinstall << _EOF -#! /sbin/sh -# -[ "\${PRE_INS_STOP}" = "yes" ] && ${TEST_DIR}/etc/init.d/${SYSVINIT_NAME} stop -exit 0 -_EOF - -## Build postinstall file -echo "Building postinstall file..." -cat > postinstall << _EOF -#! /sbin/sh -# -[ -f \${PKG_INSTALL_ROOT}${sysconfdir}/ssh_config ] || \\ - cp -p \${PKG_INSTALL_ROOT}${sysconfdir}/ssh_config.default \\ - \${PKG_INSTALL_ROOT}${sysconfdir}/ssh_config -[ -f \${PKG_INSTALL_ROOT}${sysconfdir}/sshd_config ] || \\ - cp -p \${PKG_INSTALL_ROOT}${sysconfdir}/sshd_config.default \\ - \${PKG_INSTALL_ROOT}${sysconfdir}/sshd_config -[ -f \${PKG_INSTALL_ROOT}${sysconfdir}/ssh_prng_cmds.default ] && { - [ -f \${PKG_INSTALL_ROOT}${sysconfdir}/ssh_prng_cmds ] || \\ - cp -p \${PKG_INSTALL_ROOT}${sysconfdir}/ssh_prng_cmds.default \\ - \${PKG_INSTALL_ROOT}${sysconfdir}/ssh_prng_cmds -} - -# make rc?.d dirs only if we are doing a test install -[ -n "${TEST_DIR}" ] && { - [ "$RCS_D" = yes ] && mkdir -p ${TEST_DIR}/etc/rcS.d - mkdir -p ${TEST_DIR}/etc/rc0.d - mkdir -p ${TEST_DIR}/etc/rc1.d - mkdir -p ${TEST_DIR}/etc/rc2.d -} - -if [ "\${USE_SYM_LINKS}" = yes ] -then - [ "$RCS_D" = yes ] && \ -installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rcS.d/K30${SYSVINIT_NAME}=../init.d/${SYSVINIT_NAME} s - installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rc0.d/K30${SYSVINIT_NAME}=../init.d/${SYSVINIT_NAME} s - installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rc1.d/K30${SYSVINIT_NAME}=../init.d/${SYSVINIT_NAME} s - installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rc2.d/S98${SYSVINIT_NAME}=../init.d/${SYSVINIT_NAME} s -else - [ "$RCS_D" = yes ] && \ -installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rcS.d/K30${SYSVINIT_NAME}=$TEST_DIR/etc/init.d/${SYSVINIT_NAME} l - installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rc0.d/K30${SYSVINIT_NAME}=$TEST_DIR/etc/init.d/${SYSVINIT_NAME} l - installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rc1.d/K30${SYSVINIT_NAME}=$TEST_DIR/etc/init.d/${SYSVINIT_NAME} l - installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rc2.d/S98${SYSVINIT_NAME}=$TEST_DIR/etc/init.d/${SYSVINIT_NAME} l -fi - -# If piddir doesn't exist we add it. (Ie. --with-pid-dir=/var/opt/ssh) -[ -d $piddir ] || installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR$piddir d 755 root sys - -installf -f ${PKGNAME} - -# Use chroot to handle PKG_INSTALL_ROOT -if [ ! -z "\${PKG_INSTALL_ROOT}" ] -then - chroot="chroot \${PKG_INSTALL_ROOT}" -fi -# If this is a test build, we will skip the groupadd/useradd/passwd commands -if [ ! -z "${TEST_DIR}" ] -then - chroot=echo -fi - -if egrep '^[ \t]*UsePrivilegeSeparation[ \t]+no' \${PKG_INSTALL_ROOT}/$sysconfdir/sshd_config >/dev/null -then - echo "UsePrivilegeSeparation disabled in config, not creating PrivSep user" - echo "or group." -else - echo "UsePrivilegeSeparation enabled in config (or defaulting to on)." - - # create group if required - if cut -f1 -d: \${PKG_INSTALL_ROOT}/etc/group | egrep '^'$SSH_PRIVSEP_USER'\$' >/dev/null - then - echo "PrivSep group $SSH_PRIVSEP_USER already exists." - else - # Use gid of 67 if possible - if cut -f3 -d: \${PKG_INSTALL_ROOT}/etc/group | egrep '^'$SSHDGID'\$' >/dev/null - then - : - else - sshdgid="-g $SSHDGID" - fi - echo "Creating PrivSep group $SSH_PRIVSEP_USER." - \$chroot /usr/sbin/groupadd \$sshdgid $SSH_PRIVSEP_USER - fi - - # Create user if required - if cut -f1 -d: \${PKG_INSTALL_ROOT}/etc/passwd | egrep '^'$SSH_PRIVSEP_USER'\$' >/dev/null - then - echo "PrivSep user $SSH_PRIVSEP_USER already exists." - else - # Use uid of 67 if possible - if cut -f3 -d: \${PKG_INSTALL_ROOT}/etc/passwd | egrep '^'$SSHDGID'\$' >/dev/null - then - : - else - sshduid="-u $SSHDUID" - fi - echo "Creating PrivSep user $SSH_PRIVSEP_USER." - \$chroot /usr/sbin/useradd -c 'SSHD PrivSep User' -s /bin/false -g $SSH_PRIVSEP_USER \$sshduid $SSH_PRIVSEP_USER - \$chroot /usr/bin/passwd -l $SSH_PRIVSEP_USER - fi -fi - -[ "\${POST_INS_START}" = "yes" ] && ${TEST_DIR}/etc/init.d/${SYSVINIT_NAME} start -exit 0 -_EOF - -## Build preremove file -echo "Building preremove file..." -cat > preremove << _EOF -#! /sbin/sh -# -${TEST_DIR}/etc/init.d/${SYSVINIT_NAME} stop -exit 0 -_EOF - -## Build request file -echo "Building request file..." -cat > request << _EOF -trap 'exit 3' 15 -USE_SYM_LINKS=no -PRE_INS_STOP=no -POST_INS_START=no -# Use symbolic links? -ans=\`ckyorn -d n \ --p "Do you want symbolic links for the start/stop scripts? ${DEF_MSG}"\` || exit \$? -case \$ans in - [y,Y]*) USE_SYM_LINKS=yes ;; -esac - -# determine if should restart the daemon -if [ -s ${piddir}/sshd.pid -a -f ${TEST_DIR}/etc/init.d/${SYSVINIT_NAME} ] -then - ans=\`ckyorn -d n \ --p "Should the running sshd daemon be restarted? ${DEF_MSG}"\` || exit \$? - case \$ans in - [y,Y]*) PRE_INS_STOP=yes - POST_INS_START=yes - ;; - esac - -else - -# determine if we should start sshd - ans=\`ckyorn -d n \ --p "Start the sshd daemon after installing this package? ${DEF_MSG}"\` || exit \$? - case \$ans in - [y,Y]*) POST_INS_START=yes ;; - esac -fi - -# make parameters available to installation service, -# and so to any other packaging scripts -cat >\$1 <<! -USE_SYM_LINKS='\$USE_SYM_LINKS' -PRE_INS_STOP='\$PRE_INS_STOP' -POST_INS_START='\$POST_INS_START' -! -exit 0 - -_EOF - -## Build space file -echo "Building space file..." -cat > space << _EOF -# extra space required by start/stop links added by installf in postinstall -$TEST_DIR/etc/rc0.d/K30${SYSVINIT_NAME} 0 1 -$TEST_DIR/etc/rc1.d/K30${SYSVINIT_NAME} 0 1 -$TEST_DIR/etc/rc2.d/S98${SYSVINIT_NAME} 0 1 -_EOF -[ "$RCS_D" = yes ] && \ -echo "$TEST_DIR/etc/rcS.d/K30${SYSVINIT_NAME} 0 1" >> space - -## Next Build our prototype -echo "Building prototype file..." -cat >mk-proto.awk << _EOF - BEGIN { print "i pkginfo"; print "i preinstall"; \\ - print "i postinstall"; print "i preremove"; \\ - print "i request"; print "i space"; \\ - split("$SYSTEM_DIR",sys_files); } - { - for (dir in sys_files) { if ( \$3 != sys_files[dir] ) - { \$5="root"; \$6="sys"; } - else - { \$4="?"; \$5="?"; \$6="?"; break;} - } } - { print; } -_EOF -find . | egrep -v "prototype|pkginfo|mk-proto.awk" | sort | \ - pkgproto $PROTO_ARGS | nawk -f mk-proto.awk > prototype - -# /usr/local is a symlink on some systems -[ "${USR_LOCAL_IS_SYMLINK}" = yes ] && { - grep -v "^d none /usr/local ? ? ?$" prototype > prototype.new - mv prototype.new prototype -} - -## Step back a directory and now build the package. -echo "Building package.." -cd .. -pkgmk -d ${FAKE_ROOT} -f $FAKE_ROOT/prototype -o -echo | pkgtrans -os ${FAKE_ROOT} ${START}/$PKGNAME-$UNAME_S-$ARCH-$VERSION.pkg -rm -rf $FAKE_ROOT - diff --git a/crypto/openssh/contrib/solaris/opensshd.in b/crypto/openssh/contrib/solaris/opensshd.in deleted file mode 100755 index 50e18de..0000000 --- a/crypto/openssh/contrib/solaris/opensshd.in +++ /dev/null @@ -1,82 +0,0 @@ -#!/sbin/sh -# Donated code that was put under PD license. -# -# Stripped PRNGd out of it for the time being. - -umask 022 - -CAT=/usr/bin/cat -KILL=/usr/bin/kill - -prefix=%%openSSHDir%% -etcdir=%%configDir%% -piddir=%%pidDir%% - -SSHD=$prefix/sbin/sshd -PIDFILE=$piddir/sshd.pid -SSH_KEYGEN=$prefix/bin/ssh-keygen -HOST_KEY_RSA1=$etcdir/ssh_host_key -HOST_KEY_DSA=$etcdir/ssh_host_dsa_key -HOST_KEY_RSA=$etcdir/ssh_host_rsa_key - - -checkkeys() { - if [ ! -f $HOST_KEY_RSA1 ]; then - ${SSH_KEYGEN} -t rsa1 -f ${HOST_KEY_RSA1} -N "" - fi - if [ ! -f $HOST_KEY_DSA ]; then - ${SSH_KEYGEN} -t dsa -f ${HOST_KEY_DSA} -N "" - fi - if [ ! -f $HOST_KEY_RSA ]; then - ${SSH_KEYGEN} -t rsa -f ${HOST_KEY_RSA} -N "" - fi -} - -stop_service() { - if [ -r $PIDFILE -a ! -z ${PIDFILE} ]; then - PID=`${CAT} ${PIDFILE}` - fi - if [ ${PID:=0} -gt 1 -a ! "X$PID" = "X " ]; then - ${KILL} ${PID} - else - echo "Unable to read PID file" - fi -} - -start_service() { - # XXX We really should check if the service is already going, but - # XXX we will opt out at this time. - Bal - - # Check to see if we have keys that need to be made - checkkeys - - # Start SSHD - echo "starting $SSHD... \c" ; $SSHD - - sshd_rc=$? - if [ $sshd_rc -ne 0 ]; then - echo "$0: Error ${sshd_rc} starting ${SSHD}... bailing." - exit $sshd_rc - fi - echo done. -} - -case $1 in - -'start') - start_service - ;; - -'stop') - stop_service - ;; - -'restart') - stop_service - start_service - ;; - -*) - echo "$0: usage: $0 {start|stop|restart}" - ;; -esac diff --git a/crypto/openssh/contrib/ssh-copy-id b/crypto/openssh/contrib/ssh-copy-id deleted file mode 100644 index a1c0a92..0000000 --- a/crypto/openssh/contrib/ssh-copy-id +++ /dev/null @@ -1,50 +0,0 @@ -#!/bin/sh - -# Shell script to install your identity.pub on a remote machine -# Takes the remote machine name as an argument. -# Obviously, the remote machine must accept password authentication, -# or one of the other keys in your ssh-agent, for this to work. - -ID_FILE="${HOME}/.ssh/identity.pub" - -if [ "-i" = "$1" ]; then - shift - # check if we have 2 parameters left, if so the first is the new ID file - if [ -n "$2" ]; then - if expr "$1" : ".*\.pub" ; then - ID_FILE="$1" - else - ID_FILE="$1.pub" - fi - shift # and this should leave $1 as the target name - fi -else - if [ x$SSH_AUTH_SOCK != x ] ; then - GET_ID="$GET_ID ssh-add -L" - fi -fi - -if [ -z "`eval $GET_ID`" -a -r "${ID_FILE}" ] ; then - GET_ID="cat ${ID_FILE}" -fi - -if [ -z "`eval $GET_ID`" ]; then - echo "$0: ERROR: No identities found" >&2 - exit 1 -fi - -if [ "$#" -lt 1 ] || [ "$1" = "-h" ] || [ "$1" = "--help" ]; then - echo "Usage: $0 [-i [identity_file]] [user@]machine" >&2 - exit 1 -fi - -{ eval "$GET_ID" ; } | ssh $1 "umask 077; test -d .ssh || mkdir .ssh ; cat >> .ssh/authorized_keys" || exit 1 - -cat <<EOF -Now try logging into the machine, with "ssh '$1'", and check in: - - .ssh/authorized_keys - -to make sure we haven't added extra keys that you weren't expecting. - -EOF diff --git a/crypto/openssh/contrib/ssh-copy-id.1 b/crypto/openssh/contrib/ssh-copy-id.1 deleted file mode 100644 index b331fa1..0000000 --- a/crypto/openssh/contrib/ssh-copy-id.1 +++ /dev/null @@ -1,67 +0,0 @@ -.ig \" -*- nroff -*- -Copyright (c) 1999 Philip Hands Computing <http://www.hands.com/> - -Permission is granted to make and distribute verbatim copies of -this manual provided the copyright notice and this permission notice -are preserved on all copies. - -Permission is granted to copy and distribute modified versions of this -manual under the conditions for verbatim copying, provided that the -entire resulting derived work is distributed under the terms of a -permission notice identical to this one. - -Permission is granted to copy and distribute translations of this -manual into another language, under the above conditions for modified -versions, except that this permission notice may be included in -translations approved by the Free Software Foundation instead of in -the original English. -.. -.TH SSH-COPY-ID 1 "14 November 1999" "OpenSSH" -.SH NAME -ssh-copy-id \- install your identity.pub in a remote machine's authorized_keys -.SH SYNOPSIS -.B ssh-copy-id [-i [identity_file]] -.I "[user@]machine" -.br -.SH DESCRIPTION -.BR ssh-copy-id -is a script that uses ssh to log into a remote machine (presumably -using a login password, so password authentication should be enabled, -unless you've done some clever use of multiple identities) -.PP -It also changes the permissions of the remote user's home, -.BR ~/.ssh , -and -.B ~/.ssh/authorized_keys -to remove group writability (which would otherwise prevent you from logging in, if the remote -.B sshd -has -.B StrictModes -set in its configuration). -.PP -If the -.B -i -option is given then the identity file (defaults to -.BR ~/.ssh/identity.pub ) -is used, regardless of whether there are any keys in your -.BR ssh-agent . -Otherwise, if this: -.PP -.B " ssh-add -L" -.PP -provides any output, it uses that in preference to the identity file. -.PP -If the -.B -i -option is used, or the -.B ssh-add -produced no output, then it uses the contents of the identity -file. Once it has one or more fingerprints (by whatever means) it -uses ssh to append them to -.B ~/.ssh/authorized_keys -on the remote machine (creating the file, and directory, if necessary) - -.SH "SEE ALSO" -.BR ssh (1), -.BR ssh-agent (1), -.BR sshd (8) diff --git a/crypto/openssh/contrib/sshd.pam.freebsd b/crypto/openssh/contrib/sshd.pam.freebsd deleted file mode 100644 index c0bc364..0000000 --- a/crypto/openssh/contrib/sshd.pam.freebsd +++ /dev/null @@ -1,5 +0,0 @@ -sshd auth required pam_unix.so try_first_pass -sshd account required pam_unix.so -sshd password required pam_permit.so -sshd session required pam_permit.so - diff --git a/crypto/openssh/contrib/sshd.pam.generic b/crypto/openssh/contrib/sshd.pam.generic deleted file mode 100644 index cf5af30..0000000 --- a/crypto/openssh/contrib/sshd.pam.generic +++ /dev/null @@ -1,8 +0,0 @@ -#%PAM-1.0 -auth required /lib/security/pam_unix.so shadow nodelay -auth required /lib/security/pam_nologin.so -account required /lib/security/pam_unix.so -password required /lib/security/pam_cracklib.so -password required /lib/security/pam_unix.so shadow nullok use_authtok -session required /lib/security/pam_unix.so -session required /lib/security/pam_limits.so diff --git a/crypto/openssh/contrib/suse/openssh.spec b/crypto/openssh/contrib/suse/openssh.spec deleted file mode 100644 index 2b43d03..0000000 --- a/crypto/openssh/contrib/suse/openssh.spec +++ /dev/null @@ -1,199 +0,0 @@ -Summary: OpenSSH, a free Secure Shell (SSH) protocol implementation -Name: openssh -Version: 3.8.1p1 -URL: http://www.openssh.com/ -Release: 1 -Source0: openssh-%{version}.tar.gz -Copyright: BSD -Group: Applications/Internet -BuildRoot: /tmp/openssh-%{version}-buildroot -PreReq: openssl -Obsoletes: ssh -# -# (Build[ing] Prereq[uisites] only work for RPM 2.95 and newer.) -# building prerequisites -- stuff for -# OpenSSL (openssl-devel), -# TCP Wrappers (nkitb), -# and Gnome (glibdev, gtkdev, and gnlibsd) -# -BuildPrereq: openssl -BuildPrereq: nkitb -BuildPrereq: glibdev -BuildPrereq: gtkdev -BuildPrereq: gnlibsd - -%description -Ssh (Secure Shell) a program for logging into a remote machine and for -executing commands in a remote machine. It is intended to replace -rlogin and rsh, and provide secure encrypted communications between -two untrusted hosts over an insecure network. X11 connections and -arbitrary TCP/IP ports can also be forwarded over the secure channel. - -OpenSSH is OpenBSD's rework of the last free version of SSH, bringing it -up to date in terms of security and features, as well as removing all -patented algorithms to seperate libraries (OpenSSL). - -This package includes all files necessary for both the OpenSSH -client and server. Additionally, this package contains the GNOME -passphrase dialog. - -%changelog -* Mon Jun 12 2000 Damien Miller <djm@mindrot.org> -- Glob manpages to catch compressed files -* Wed Mar 15 2000 Damien Miller <djm@ibs.com.au> -- Updated for new location -- Updated for new gnome-ssh-askpass build -* Sun Dec 26 1999 Chris Saia <csaia@wtower.com> -- Made symlink to gnome-ssh-askpass called ssh-askpass -* Wed Nov 24 1999 Chris Saia <csaia@wtower.com> -- Removed patches that included /etc/pam.d/sshd, /sbin/init.d/rc.sshd, and - /var/adm/fillup-templates/rc.config.sshd, since Damien merged these into - his released tarfile -- Changed permissions on ssh_config in the install procedure to 644 from 600 - even though it was correct in the %files section and thus right in the RPMs -- Postinstall script for the server now only prints "Generating SSH host - key..." if we need to actually do this, in order to eliminate a confusing - message if an SSH host key is already in place -- Marked all manual pages as %doc(umentation) -* Mon Nov 22 1999 Chris Saia <csaia@wtower.com> -- Added flag to configure daemon with TCP Wrappers support -- Added building prerequisites (works in RPM 3.0 and newer) -* Thu Nov 18 1999 Chris Saia <csaia@wtower.com> -- Made this package correct for SuSE. -- Changed instances of pam_pwdb.so to pam_unix.so, since it works more properly - with SuSE, and lib_pwdb.so isn't installed by default. -* Mon Nov 15 1999 Damien Miller <djm@mindrot.org> -- Split subpackages further based on patch from jim knoble <jmknoble@pobox.com> -* Sat Nov 13 1999 Damien Miller <djm@mindrot.org> -- Added 'Obsoletes' directives -* Tue Nov 09 1999 Damien Miller <djm@ibs.com.au> -- Use make install -- Subpackages -* Mon Nov 08 1999 Damien Miller <djm@ibs.com.au> -- Added links for slogin -- Fixed perms on manpages -* Sat Oct 30 1999 Damien Miller <djm@ibs.com.au> -- Renamed init script -* Fri Oct 29 1999 Damien Miller <djm@ibs.com.au> -- Back to old binary names -* Thu Oct 28 1999 Damien Miller <djm@ibs.com.au> -- Use autoconf -- New binary names -* Wed Oct 27 1999 Damien Miller <djm@ibs.com.au> -- Initial RPMification, based on Jan "Yenya" Kasprzak's <kas@fi.muni.cz> spec. - -%prep - -%setup -q - -%build -CFLAGS="$RPM_OPT_FLAGS" \ -./configure --prefix=/usr \ - --sysconfdir=/etc/ssh \ - --datadir=/usr/share/openssh \ - --with-pam \ - --with-gnome-askpass \ - --with-tcp-wrappers \ - --with-ipv4-default \ - --libexecdir=/usr/lib/ssh -make - -cd contrib -gcc -O -g `gnome-config --cflags gnome gnomeui` \ - gnome-ssh-askpass.c -o gnome-ssh-askpass \ - `gnome-config --libs gnome gnomeui` -cd .. - -%install -rm -rf $RPM_BUILD_ROOT -make install DESTDIR=$RPM_BUILD_ROOT/ -install -d $RPM_BUILD_ROOT/etc/ssh/ -install -d $RPM_BUILD_ROOT/etc/pam.d/ -install -d $RPM_BUILD_ROOT/sbin/init.d/ -install -d $RPM_BUILD_ROOT/var/adm/fillup-templates -install -d $RPM_BUILD_ROOT/usr/lib/ssh -install -m644 contrib/sshd.pam.generic $RPM_BUILD_ROOT/etc/pam.d/sshd -install -m744 contrib/suse/rc.sshd $RPM_BUILD_ROOT/sbin/init.d/sshd -ln -s ../../sbin/init.d/sshd $RPM_BUILD_ROOT/usr/sbin/rcsshd -install -s contrib/gnome-ssh-askpass $RPM_BUILD_ROOT/usr/lib/ssh/gnome-ssh-askpass -ln -s gnome-ssh-askpass $RPM_BUILD_ROOT/usr/lib/ssh/ssh-askpass -install -m744 contrib/suse/rc.config.sshd \ - $RPM_BUILD_ROOT/var/adm/fillup-templates - -%clean -rm -rf $RPM_BUILD_ROOT - -%post -if [ "$1" = 1 ]; then - echo "Creating SSH stop/start scripts in the rc directories..." - ln -s ../sshd /sbin/init.d/rc2.d/K20sshd - ln -s ../sshd /sbin/init.d/rc2.d/S20sshd - ln -s ../sshd /sbin/init.d/rc3.d/K20sshd - ln -s ../sshd /sbin/init.d/rc3.d/S20sshd -fi -echo "Updating /etc/rc.config..." -if [ -x /bin/fillup ] ; then - /bin/fillup -q -d = etc/rc.config var/adm/fillup-templates/rc.config.sshd -else - echo "ERROR: fillup not found. This should NOT happen in SuSE Linux." - echo "Update /etc/rc.config by hand from the following template file:" - echo " /var/adm/fillup-templates/rc.config.sshd" -fi -if [ ! -f /etc/ssh/ssh_host_key -o ! -s /etc/ssh/ssh_host_key ]; then - echo "Generating SSH host key..." - /usr/bin/ssh-keygen -b 1024 -f /etc/ssh/ssh_host_key -N '' >&2 -fi -if [ ! -f /etc/ssh/ssh_host_dsa_key -o ! -s /etc/ssh/ssh_host_dsa_key ]; then - echo "Generating SSH DSA host key..." - /usr/bin/ssh-keygen -d -f /etc/ssh/ssh_host_dsa_key -N '' >&2 -fi -if test -r /var/run/sshd.pid -then - echo "Restarting the running SSH daemon..." - /usr/sbin/rcsshd restart >&2 -fi - -%preun -if [ "$1" = 0 ] -then - echo "Stopping the SSH daemon..." - /usr/sbin/rcsshd stop >&2 - echo "Removing SSH stop/start scripts from the rc directories..." - rm /sbin/init.d/rc2.d/K20sshd - rm /sbin/init.d/rc2.d/S20sshd - rm /sbin/init.d/rc3.d/K20sshd - rm /sbin/init.d/rc3.d/S20sshd -fi - -%files -%defattr(-,root,root) -%doc ChangeLog OVERVIEW README* -%doc RFC.nroff TODO CREDITS LICENCE -%attr(0755,root,root) %dir /etc/ssh -%attr(0644,root,root) %config /etc/ssh/ssh_config -%attr(0600,root,root) %config /etc/ssh/sshd_config -%attr(0600,root,root) %config /etc/ssh/moduli -%attr(0644,root,root) %config /etc/pam.d/sshd -%attr(0755,root,root) %config /sbin/init.d/sshd -%attr(0755,root,root) /usr/bin/ssh-keygen -%attr(0755,root,root) /usr/bin/scp -%attr(4755,root,root) /usr/bin/ssh -%attr(-,root,root) /usr/bin/slogin -%attr(0755,root,root) /usr/bin/ssh-agent -%attr(0755,root,root) /usr/bin/ssh-add -%attr(0755,root,root) /usr/bin/ssh-keyscan -%attr(0755,root,root) /usr/bin/sftp -%attr(0755,root,root) /usr/sbin/sshd -%attr(-,root,root) /usr/sbin/rcsshd -%attr(0755,root,root) %dir /usr/lib/ssh -%attr(0755,root,root) /usr/lib/ssh/ssh-askpass -%attr(0755,root,root) /usr/lib/ssh/gnome-ssh-askpass -%attr(0644,root,root) %doc /usr/man/man1/scp.1* -%attr(0644,root,root) %doc /usr/man/man1/ssh.1* -%attr(-,root,root) %doc /usr/man/man1/slogin.1* -%attr(0644,root,root) %doc /usr/man/man1/ssh-agent.1* -%attr(0644,root,root) %doc /usr/man/man1/ssh-add.1* -%attr(0644,root,root) %doc /usr/man/man1/ssh-keygen.1* -%attr(0644,root,root) %doc /usr/man/man8/sshd.8* -%attr(0644,root,root) /var/adm/fillup-templates/rc.config.sshd - diff --git a/crypto/openssh/contrib/suse/rc.config.sshd b/crypto/openssh/contrib/suse/rc.config.sshd deleted file mode 100644 index baaa7a5..0000000 --- a/crypto/openssh/contrib/suse/rc.config.sshd +++ /dev/null @@ -1,5 +0,0 @@ -# -# Start the Secure Shell (SSH) Daemon? -# -START_SSHD="yes" - diff --git a/crypto/openssh/contrib/suse/rc.sshd b/crypto/openssh/contrib/suse/rc.sshd deleted file mode 100644 index f7d431e..0000000 --- a/crypto/openssh/contrib/suse/rc.sshd +++ /dev/null @@ -1,80 +0,0 @@ -#! /bin/sh -# Copyright (c) 1995-1998 SuSE GmbH Nuernberg, Germany. -# -# Author: Chris Saia <csaia@wtower.com> -# -# /sbin/init.d/sshd -# -# and symbolic its link -# -# /sbin/rcsshd -# - -. /etc/rc.config - -# Determine the base and follow a runlevel link name. -base=${0##*/} -link=${base#*[SK][0-9][0-9]} - -# Force execution if not called by a runlevel directory. -test $link = $base && START_SSHD=yes -test "$START_SSHD" = yes || exit 0 - -# The echo return value for success (defined in /etc/rc.config). -return=$rc_done -case "$1" in - start) - echo -n "Starting service sshd" - ## Start daemon with startproc(8). If this fails - ## the echo return value is set appropriate. - - startproc /usr/sbin/sshd || return=$rc_failed - - echo -e "$return" - ;; - stop) - echo -n "Stopping service sshd" - ## Stop daemon with killproc(8) and if this fails - ## set echo the echo return value. - - killproc -TERM /usr/sbin/sshd || return=$rc_failed - - echo -e "$return" - ;; - restart) - ## If first returns OK call the second, if first or - ## second command fails, set echo return value. - $0 stop && $0 start || return=$rc_failed - ;; - reload) - ## Choose ONE of the following two cases: - - ## First possibility: A few services accepts a signal - ## to reread the (changed) configuration. - - echo -n "Reload service sshd" - killproc -HUP /usr/sbin/sshd || return=$rc_failed - echo -e "$return" - ;; - status) - echo -n "Checking for service sshd" - ## Check status with checkproc(8), if process is running - ## checkproc will return with exit status 0. - - checkproc /usr/sbin/sshd && echo OK || echo No process - ;; - probe) - ## Optional: Probe for the necessity of a reload, - ## give out the argument which is required for a reload. - - test /etc/ssh/sshd_config -nt /var/run/sshd.pid && echo reload - ;; - *) - echo "Usage: $0 {start|stop|status|restart|reload[|probe]}" - exit 1 - ;; -esac - -# Inform the caller not only verbosely and set an exit status. -test "$return" = "$rc_done" || exit 1 -exit 0 diff --git a/crypto/openssh/includes.h b/crypto/openssh/includes.h index 32e9b84..0dc2fb7 100644 --- a/crypto/openssh/includes.h +++ b/crypto/openssh/includes.h @@ -1,4 +1,4 @@ -/* $OpenBSD: includes.h,v 1.17 2002/01/26 16:44:22 stevesk Exp $ */ +/* $OpenBSD: includes.h,v 1.18 2004/06/13 15:03:02 djm Exp $ */ /* $FreeBSD$ */ /* @@ -34,6 +34,7 @@ __RCSID(msg) #include <grp.h> #include <time.h> #include <dirent.h> +#include <stddef.h> #ifdef HAVE_LIMITS_H # include <limits.h> /* For PATH_MAX */ @@ -181,6 +182,16 @@ __RCSID(msg) # include <kafs.h> #endif +/* + * On HP-UX 11.11, shadow.h and prot.h provide conflicting declarations + * of getspnam when _INCLUDE__STDC__ is defined, so we unset it here. + */ +#ifdef __hpux +# ifdef _INCLUDE__STDC__ +# undef _INCLUDE__STDC__ +# endif +#endif + #include <openssl/opensslv.h> /* For OPENSSL_VERSION_NUMBER */ #include "defines.h" diff --git a/crypto/openssh/key.c b/crypto/openssh/key.c index 323e6ff..21b0869 100644 --- a/crypto/openssh/key.c +++ b/crypto/openssh/key.c @@ -32,7 +32,7 @@ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #include "includes.h" -RCSID("$OpenBSD: key.c,v 1.55 2003/11/10 16:23:41 jakob Exp $"); +RCSID("$OpenBSD: key.c,v 1.56 2004/07/28 09:40:29 markus Exp $"); #include <openssl/evp.h> @@ -782,7 +782,7 @@ key_sign( return ssh_rsa_sign(key, sigp, lenp, data, datalen); break; default: - error("key_sign: illegal key type %d", key->type); + error("key_sign: invalid key type %d", key->type); return -1; break; } @@ -809,7 +809,7 @@ key_verify( return ssh_rsa_verify(key, signature, signaturelen, data, datalen); break; default: - error("key_verify: illegal key type %d", key->type); + error("key_verify: invalid key type %d", key->type); return -1; break; } diff --git a/crypto/openssh/log.h b/crypto/openssh/log.h index ca4d7bf..ec64752 100644 --- a/crypto/openssh/log.h +++ b/crypto/openssh/log.h @@ -1,4 +1,4 @@ -/* $OpenBSD: log.h,v 1.10 2003/09/23 20:17:11 markus Exp $ */ +/* $OpenBSD: log.h,v 1.11 2004/06/21 22:02:58 djm Exp $ */ /* $FreeBSD$ */ /* @@ -62,7 +62,7 @@ LogLevel log_level_number(char *); #define debug2 ssh_debug2 #define debug3 ssh_debug3 -void fatal(const char *, ...) __attribute__((format(printf, 1, 2))); +void fatal(const char *, ...) __dead __attribute__((format(printf, 1, 2))); void error(const char *, ...) __attribute__((format(printf, 1, 2))); void logit(const char *, ...) __attribute__((format(printf, 1, 2))); void verbose(const char *, ...) __attribute__((format(printf, 1, 2))); @@ -71,5 +71,5 @@ void debug2(const char *, ...) __attribute__((format(printf, 1, 2))); void debug3(const char *, ...) __attribute__((format(printf, 1, 2))); void do_log(LogLevel, const char *, va_list); -void cleanup_exit(int); +void cleanup_exit(int) __dead; #endif diff --git a/crypto/openssh/loginrec.c b/crypto/openssh/loginrec.c index 90f9f74..18eca38 100644 --- a/crypto/openssh/loginrec.c +++ b/crypto/openssh/loginrec.c @@ -158,8 +158,8 @@ #include "log.h" #include "atomicio.h" +RCSID("$Id: loginrec.c,v 1.58 2004/08/15 09:12:52 djm Exp $"); RCSID("$FreeBSD$"); -RCSID("$Id: loginrec.c,v 1.54 2004/02/10 05:49:35 dtucker Exp $"); #ifdef HAVE_UTIL_H # include <util.h> @@ -436,6 +436,11 @@ login_write (struct logininfo *li) #ifdef USE_WTMPX wtmpx_write_entry(li); #endif +#ifdef CUSTOM_SYS_AUTH_RECORD_LOGIN + if (li->type == LTYPE_LOGIN && + !sys_auth_record_login(li->username,li->hostname,li->line)) + logit("Writing login record failed for %s", li->username); +#endif return 0; } @@ -815,8 +820,8 @@ utmp_write_direct(struct logininfo *li, struct utmp *ut) endttyent(); if((struct ttyent *)0 == ty) { - logit("utmp_write_entry: tty not found"); - return(1); + logit("%s: tty not found", __func__); + return (0); } #else /* FIXME */ @@ -825,7 +830,18 @@ utmp_write_direct(struct logininfo *li, struct utmp *ut) #endif /* HAVE_GETTTYENT */ if (tty > 0 && (fd = open(UTMP_FILE, O_RDWR|O_CREAT, 0644)) >= 0) { - (void)lseek(fd, (off_t)(tty * sizeof(struct utmp)), SEEK_SET); + off_t pos, ret; + + pos = (off_t)tty * sizeof(struct utmp); + if ((ret = lseek(fd, pos, SEEK_SET)) == -1) { + logit("%s: llseek: %s", strerror(errno)); + return (0); + } + if (ret != pos) { + logit("%s: Couldn't seek to tty %s slot in %s", tty, + UTMP_FILE); + return (0); + } /* * Prevent luser from zero'ing out ut_host. * If the new ut_line is empty but the old one is not @@ -838,9 +854,17 @@ utmp_write_direct(struct logininfo *li, struct utmp *ut) (void)memcpy(ut->ut_host, old_ut.ut_host, sizeof(ut->ut_host)); } - (void)lseek(fd, (off_t)(tty * sizeof(struct utmp)), SEEK_SET); + if ((ret = lseek(fd, pos, SEEK_SET)) == -1) { + logit("%s: llseek: %s", __func__, strerror(errno)); + return (0); + } + if (ret != pos) { + logit("%s: Couldn't seek to tty %s slot in %s", + __func__, tty, UTMP_FILE); + return (0); + } if (atomicio(vwrite, fd, ut, sizeof(*ut)) != sizeof(*ut)) - logit("utmp_write_direct: error writing %s: %s", + logit("%s: error writing %s: %s", __func__, UTMP_FILE, strerror(errno)); (void)close(fd); diff --git a/crypto/openssh/moduli.h b/crypto/openssh/moduli.h deleted file mode 100644 index 9cd1cd3..0000000 --- a/crypto/openssh/moduli.h +++ /dev/null @@ -1,23 +0,0 @@ -/* $OpenBSD: moduli.h,v 1.1 2003/07/28 09:49:56 djm Exp $ */ - -#include <sys/types.h> -#include <openssl/bn.h> - -/* - * Using virtual memory can cause thrashing. This should be the largest - * number that is supported without a large amount of disk activity -- - * that would increase the run time from hours to days or weeks! - */ -#define LARGE_MINIMUM (8UL) /* megabytes */ - -/* - * Do not increase this number beyond the unsigned integer bit size. - * Due to a multiple of 4, it must be LESS than 128 (yielding 2**30 bits). - */ -#define LARGE_MAXIMUM (127UL) /* megabytes */ - -/* Minimum number of primality tests to perform */ -#define TRIAL_MINIMUM (4) - -int gen_candidates(FILE *, int, int, BIGNUM *); -int prime_test(FILE *, FILE *, u_int32_t, u_int32_t); diff --git a/crypto/openssh/monitor.c b/crypto/openssh/monitor.c index c04d1f7..1fa6db0 100644 --- a/crypto/openssh/monitor.c +++ b/crypto/openssh/monitor.c @@ -25,7 +25,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: monitor.c,v 1.55 2004/02/05 05:37:17 dtucker Exp $"); +RCSID("$OpenBSD: monitor.c,v 1.61 2004/07/17 05:31:41 dtucker Exp $"); RCSID("$FreeBSD$"); #include <openssl/dh.h> @@ -72,7 +72,6 @@ RCSID("$FreeBSD$"); #include "bufaux.h" #include "compat.h" #include "ssh2.h" -#include "mpaux.h" #ifdef GSSAPI #include "ssh-gss.h" @@ -89,6 +88,7 @@ extern u_char session_id[]; extern Buffer input, output; extern Buffer auth_debug; extern int auth_debug_init; +extern Buffer loginmsg; /* State exported from the child */ @@ -360,9 +360,9 @@ monitor_set_child_handler(pid_t pid) } static void -monitor_child_handler(int signal) +monitor_child_handler(int sig) { - kill(monitor_child_pid, signal); + kill(monitor_child_pid, sig); } void @@ -477,7 +477,7 @@ monitor_reset_key_state(void) } int -mm_answer_moduli(int socket, Buffer *m) +mm_answer_moduli(int sock, Buffer *m) { DH *dh; int min, want, max; @@ -507,12 +507,12 @@ mm_answer_moduli(int socket, Buffer *m) DH_free(dh); } - mm_request_send(socket, MONITOR_ANS_MODULI, m); + mm_request_send(sock, MONITOR_ANS_MODULI, m); return (0); } int -mm_answer_sign(int socket, Buffer *m) +mm_answer_sign(int sock, Buffer *m) { Key *key; u_char *p; @@ -548,7 +548,7 @@ mm_answer_sign(int socket, Buffer *m) xfree(p); xfree(signature); - mm_request_send(socket, MONITOR_ANS_SIGN, m); + mm_request_send(sock, MONITOR_ANS_SIGN, m); /* Turn on permissions for getpwnam */ monitor_permit(mon_dispatch, MONITOR_REQ_PWNAM, 1); @@ -559,9 +559,9 @@ mm_answer_sign(int socket, Buffer *m) /* Retrieves the password entry and also checks if the user is permitted */ int -mm_answer_pwnamallow(int socket, Buffer *m) +mm_answer_pwnamallow(int sock, Buffer *m) { - char *login; + char *username; struct passwd *pwent; int allowed = 0; @@ -570,13 +570,13 @@ mm_answer_pwnamallow(int socket, Buffer *m) if (authctxt->attempt++ != 0) fatal("%s: multiple attempts for getpwnam", __func__); - login = buffer_get_string(m, NULL); + username = buffer_get_string(m, NULL); - pwent = getpwnamallow(login); + pwent = getpwnamallow(username); - authctxt->user = xstrdup(login); - setproctitle("%s [priv]", pwent ? login : "unknown"); - xfree(login); + authctxt->user = xstrdup(username); + setproctitle("%s [priv]", pwent ? username : "unknown"); + xfree(username); buffer_clear(m); @@ -603,7 +603,7 @@ mm_answer_pwnamallow(int socket, Buffer *m) out: debug3("%s: sending MONITOR_ANS_PWNAM: %d", __func__, allowed); - mm_request_send(socket, MONITOR_ANS_PWNAM, m); + mm_request_send(sock, MONITOR_ANS_PWNAM, m); /* For SSHv1 allow authentication now */ if (!compat20) @@ -622,14 +622,14 @@ mm_answer_pwnamallow(int socket, Buffer *m) return (0); } -int mm_answer_auth2_read_banner(int socket, Buffer *m) +int mm_answer_auth2_read_banner(int sock, Buffer *m) { char *banner; buffer_clear(m); banner = auth2_read_banner(); buffer_put_cstring(m, banner != NULL ? banner : ""); - mm_request_send(socket, MONITOR_ANS_AUTH2_READ_BANNER, m); + mm_request_send(sock, MONITOR_ANS_AUTH2_READ_BANNER, m); if (banner != NULL) xfree(banner); @@ -638,7 +638,7 @@ int mm_answer_auth2_read_banner(int socket, Buffer *m) } int -mm_answer_authserv(int socket, Buffer *m) +mm_answer_authserv(int sock, Buffer *m) { monitor_permit_authentications(1); @@ -656,7 +656,7 @@ mm_answer_authserv(int socket, Buffer *m) } int -mm_answer_authpassword(int socket, Buffer *m) +mm_answer_authpassword(int sock, Buffer *m) { static int call_count; char *passwd; @@ -674,7 +674,7 @@ mm_answer_authpassword(int socket, Buffer *m) buffer_put_int(m, authenticated); debug3("%s: sending result %d", __func__, authenticated); - mm_request_send(socket, MONITOR_ANS_AUTHPASSWORD, m); + mm_request_send(sock, MONITOR_ANS_AUTHPASSWORD, m); call_count++; if (plen == 0 && call_count == 1) @@ -688,7 +688,7 @@ mm_answer_authpassword(int socket, Buffer *m) #ifdef BSD_AUTH int -mm_answer_bsdauthquery(int socket, Buffer *m) +mm_answer_bsdauthquery(int sock, Buffer *m) { char *name, *infotxt; u_int numprompts; @@ -705,7 +705,7 @@ mm_answer_bsdauthquery(int socket, Buffer *m) buffer_put_cstring(m, prompts[0]); debug3("%s: sending challenge success: %u", __func__, success); - mm_request_send(socket, MONITOR_ANS_BSDAUTHQUERY, m); + mm_request_send(sock, MONITOR_ANS_BSDAUTHQUERY, m); if (success) { xfree(name); @@ -718,7 +718,7 @@ mm_answer_bsdauthquery(int socket, Buffer *m) } int -mm_answer_bsdauthrespond(int socket, Buffer *m) +mm_answer_bsdauthrespond(int sock, Buffer *m) { char *response; int authok; @@ -737,7 +737,7 @@ mm_answer_bsdauthrespond(int socket, Buffer *m) buffer_put_int(m, authok); debug3("%s: sending authenticated: %d", __func__, authok); - mm_request_send(socket, MONITOR_ANS_BSDAUTHRESPOND, m); + mm_request_send(sock, MONITOR_ANS_BSDAUTHRESPOND, m); auth_method = "bsdauth"; @@ -747,7 +747,7 @@ mm_answer_bsdauthrespond(int socket, Buffer *m) #ifdef SKEY int -mm_answer_skeyquery(int socket, Buffer *m) +mm_answer_skeyquery(int sock, Buffer *m) { struct skey skey; char challenge[1024]; @@ -762,13 +762,13 @@ mm_answer_skeyquery(int socket, Buffer *m) buffer_put_cstring(m, challenge); debug3("%s: sending challenge success: %u", __func__, success); - mm_request_send(socket, MONITOR_ANS_SKEYQUERY, m); + mm_request_send(sock, MONITOR_ANS_SKEYQUERY, m); return (0); } int -mm_answer_skeyrespond(int socket, Buffer *m) +mm_answer_skeyrespond(int sock, Buffer *m) { char *response; int authok; @@ -786,7 +786,7 @@ mm_answer_skeyrespond(int socket, Buffer *m) buffer_put_int(m, authok); debug3("%s: sending authenticated: %d", __func__, authok); - mm_request_send(socket, MONITOR_ANS_SKEYRESPOND, m); + mm_request_send(sock, MONITOR_ANS_SKEYRESPOND, m); auth_method = "skey"; @@ -796,7 +796,7 @@ mm_answer_skeyrespond(int socket, Buffer *m) #ifdef USE_PAM int -mm_answer_pam_start(int socket, Buffer *m) +mm_answer_pam_start(int sock, Buffer *m) { if (!options.use_pam) fatal("UsePAM not set, but ended up in %s anyway", __func__); @@ -809,7 +809,7 @@ mm_answer_pam_start(int socket, Buffer *m) } int -mm_answer_pam_account(int socket, Buffer *m) +mm_answer_pam_account(int sock, Buffer *m) { u_int ret; @@ -820,7 +820,7 @@ mm_answer_pam_account(int socket, Buffer *m) buffer_put_int(m, ret); - mm_request_send(socket, MONITOR_ANS_PAM_ACCOUNT, m); + mm_request_send(sock, MONITOR_ANS_PAM_ACCOUNT, m); return (ret); } @@ -829,7 +829,7 @@ static void *sshpam_ctxt, *sshpam_authok; extern KbdintDevice sshpam_device; int -mm_answer_pam_init_ctx(int socket, Buffer *m) +mm_answer_pam_init_ctx(int sock, Buffer *m) { debug3("%s", __func__); @@ -843,12 +843,12 @@ mm_answer_pam_init_ctx(int socket, Buffer *m) } else { buffer_put_int(m, 0); } - mm_request_send(socket, MONITOR_ANS_PAM_INIT_CTX, m); + mm_request_send(sock, MONITOR_ANS_PAM_INIT_CTX, m); return (0); } int -mm_answer_pam_query(int socket, Buffer *m) +mm_answer_pam_query(int sock, Buffer *m) { char *name, *info, **prompts; u_int num, *echo_on; @@ -877,12 +877,12 @@ mm_answer_pam_query(int socket, Buffer *m) xfree(prompts); if (echo_on != NULL) xfree(echo_on); - mm_request_send(socket, MONITOR_ANS_PAM_QUERY, m); + mm_request_send(sock, MONITOR_ANS_PAM_QUERY, m); return (0); } int -mm_answer_pam_respond(int socket, Buffer *m) +mm_answer_pam_respond(int sock, Buffer *m) { char **resp; u_int num; @@ -904,7 +904,7 @@ mm_answer_pam_respond(int socket, Buffer *m) } buffer_clear(m); buffer_put_int(m, ret); - mm_request_send(socket, MONITOR_ANS_PAM_RESPOND, m); + mm_request_send(sock, MONITOR_ANS_PAM_RESPOND, m); auth_method = "keyboard-interactive/pam"; if (ret == 0) sshpam_authok = sshpam_ctxt; @@ -912,13 +912,13 @@ mm_answer_pam_respond(int socket, Buffer *m) } int -mm_answer_pam_free_ctx(int socket, Buffer *m) +mm_answer_pam_free_ctx(int sock, Buffer *m) { debug3("%s", __func__); (sshpam_device.free_ctx)(sshpam_ctxt); buffer_clear(m); - mm_request_send(socket, MONITOR_ANS_PAM_FREE_CTX, m); + mm_request_send(sock, MONITOR_ANS_PAM_FREE_CTX, m); return (sshpam_authok == sshpam_ctxt); } #endif @@ -935,7 +935,7 @@ mm_append_debug(Buffer *m) } int -mm_answer_keyallowed(int socket, Buffer *m) +mm_answer_keyallowed(int sock, Buffer *m) { Key *key; char *cuser, *chost; @@ -1005,7 +1005,7 @@ mm_answer_keyallowed(int socket, Buffer *m) mm_append_debug(m); - mm_request_send(socket, MONITOR_ANS_KEYALLOWED, m); + mm_request_send(sock, MONITOR_ANS_KEYALLOWED, m); if (type == MM_RSAHOSTKEY) monitor_permit(mon_dispatch, MONITOR_REQ_RSACHALLENGE, allowed); @@ -1126,7 +1126,7 @@ monitor_valid_hostbasedblob(u_char *data, u_int datalen, char *cuser, } int -mm_answer_keyverify(int socket, Buffer *m) +mm_answer_keyverify(int sock, Buffer *m) { Key *key; u_char *signature, *data, *blob; @@ -1176,7 +1176,7 @@ mm_answer_keyverify(int socket, Buffer *m) buffer_clear(m); buffer_put_int(m, verified); - mm_request_send(socket, MONITOR_ANS_KEYVERIFY, m); + mm_request_send(sock, MONITOR_ANS_KEYVERIFY, m); return (verified); } @@ -1218,7 +1218,7 @@ mm_session_close(Session *s) } int -mm_answer_pty(int socket, Buffer *m) +mm_answer_pty(int sock, Buffer *m) { extern struct monitor *pmonitor; Session *s; @@ -1240,10 +1240,6 @@ mm_answer_pty(int socket, Buffer *m) buffer_put_int(m, 1); buffer_put_cstring(m, s->tty); - mm_request_send(socket, MONITOR_ANS_PTY, m); - - mm_send_fd(socket, s->ptyfd); - mm_send_fd(socket, s->ttyfd); /* We need to trick ttyslot */ if (dup2(s->ttyfd, 0) == -1) @@ -1254,6 +1250,15 @@ mm_answer_pty(int socket, Buffer *m) /* Now we can close the file descriptor again */ close(0); + /* send messages generated by record_login */ + buffer_put_string(m, buffer_ptr(&loginmsg), buffer_len(&loginmsg)); + buffer_clear(&loginmsg); + + mm_request_send(sock, MONITOR_ANS_PTY, m); + + mm_send_fd(sock, s->ptyfd); + mm_send_fd(sock, s->ttyfd); + /* make sure nothing uses fd 0 */ if ((fd0 = open(_PATH_DEVNULL, O_RDONLY)) < 0) fatal("%s: open(/dev/null): %s", __func__, strerror(errno)); @@ -1274,12 +1279,12 @@ mm_answer_pty(int socket, Buffer *m) if (s != NULL) mm_session_close(s); buffer_put_int(m, 0); - mm_request_send(socket, MONITOR_ANS_PTY, m); + mm_request_send(sock, MONITOR_ANS_PTY, m); return (0); } int -mm_answer_pty_cleanup(int socket, Buffer *m) +mm_answer_pty_cleanup(int sock, Buffer *m) { Session *s; char *tty; @@ -1295,7 +1300,7 @@ mm_answer_pty_cleanup(int socket, Buffer *m) } int -mm_answer_sesskey(int socket, Buffer *m) +mm_answer_sesskey(int sock, Buffer *m) { BIGNUM *p; int rsafail; @@ -1316,7 +1321,7 @@ mm_answer_sesskey(int socket, Buffer *m) BN_clear_free(p); - mm_request_send(socket, MONITOR_ANS_SESSKEY, m); + mm_request_send(sock, MONITOR_ANS_SESSKEY, m); /* Turn on permissions for sessid passing */ monitor_permit(mon_dispatch, MONITOR_REQ_SESSID, 1); @@ -1325,7 +1330,7 @@ mm_answer_sesskey(int socket, Buffer *m) } int -mm_answer_sessid(int socket, Buffer *m) +mm_answer_sessid(int sock, Buffer *m) { int i; @@ -1343,7 +1348,7 @@ mm_answer_sessid(int socket, Buffer *m) } int -mm_answer_rsa_keyallowed(int socket, Buffer *m) +mm_answer_rsa_keyallowed(int sock, Buffer *m) { BIGNUM *client_n; Key *key = NULL; @@ -1383,7 +1388,7 @@ mm_answer_rsa_keyallowed(int socket, Buffer *m) mm_append_debug(m); - mm_request_send(socket, MONITOR_ANS_RSAKEYALLOWED, m); + mm_request_send(sock, MONITOR_ANS_RSAKEYALLOWED, m); monitor_permit(mon_dispatch, MONITOR_REQ_RSACHALLENGE, allowed); monitor_permit(mon_dispatch, MONITOR_REQ_RSARESPONSE, 0); @@ -1391,7 +1396,7 @@ mm_answer_rsa_keyallowed(int socket, Buffer *m) } int -mm_answer_rsa_challenge(int socket, Buffer *m) +mm_answer_rsa_challenge(int sock, Buffer *m) { Key *key = NULL; u_char *blob; @@ -1417,7 +1422,7 @@ mm_answer_rsa_challenge(int socket, Buffer *m) buffer_put_bignum2(m, ssh1_challenge); debug3("%s sending reply", __func__); - mm_request_send(socket, MONITOR_ANS_RSACHALLENGE, m); + mm_request_send(sock, MONITOR_ANS_RSACHALLENGE, m); monitor_permit(mon_dispatch, MONITOR_REQ_RSARESPONSE, 1); @@ -1427,7 +1432,7 @@ mm_answer_rsa_challenge(int socket, Buffer *m) } int -mm_answer_rsa_response(int socket, Buffer *m) +mm_answer_rsa_response(int sock, Buffer *m) { Key *key = NULL; u_char *blob, *response; @@ -1466,13 +1471,13 @@ mm_answer_rsa_response(int socket, Buffer *m) buffer_clear(m); buffer_put_int(m, success); - mm_request_send(socket, MONITOR_ANS_RSARESPONSE, m); + mm_request_send(sock, MONITOR_ANS_RSARESPONSE, m); return (success); } int -mm_answer_term(int socket, Buffer *req) +mm_answer_term(int sock, Buffer *req) { extern struct monitor *pmonitor; int res, status; @@ -1489,7 +1494,7 @@ mm_answer_term(int socket, Buffer *req) res = WIFEXITED(status) ? WEXITSTATUS(status) : 1; /* Terminate process */ - exit (res); + exit(res); } void @@ -1556,6 +1561,7 @@ mm_get_kex(Buffer *m) fatal("mm_get_get: internal error: bad session id"); kex->we_need = buffer_get_int(m); kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server; + kex->kex[KEX_DH_GRP14_SHA1] = kexdh_server; kex->kex[KEX_DH_GEX_SHA1] = kexgex_server; kex->server = 1; kex->hostkey_type = buffer_get_int(m); @@ -1749,23 +1755,23 @@ monitor_reinit(struct monitor *mon) #ifdef GSSAPI int -mm_answer_gss_setup_ctx(int socket, Buffer *m) +mm_answer_gss_setup_ctx(int sock, Buffer *m) { - gss_OID_desc oid; + gss_OID_desc goid; OM_uint32 major; u_int len; - oid.elements = buffer_get_string(m, &len); - oid.length = len; + goid.elements = buffer_get_string(m, &len); + goid.length = len; - major = ssh_gssapi_server_ctx(&gsscontext, &oid); + major = ssh_gssapi_server_ctx(&gsscontext, &goid); - xfree(oid.elements); + xfree(goid.elements); buffer_clear(m); buffer_put_int(m, major); - mm_request_send(socket,MONITOR_ANS_GSSSETUP, m); + mm_request_send(sock,MONITOR_ANS_GSSSETUP, m); /* Now we have a context, enable the step */ monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 1); @@ -1774,7 +1780,7 @@ mm_answer_gss_setup_ctx(int socket, Buffer *m) } int -mm_answer_gss_accept_ctx(int socket, Buffer *m) +mm_answer_gss_accept_ctx(int sock, Buffer *m) { gss_buffer_desc in; gss_buffer_desc out = GSS_C_EMPTY_BUFFER; @@ -1791,7 +1797,7 @@ mm_answer_gss_accept_ctx(int socket, Buffer *m) buffer_put_int(m, major); buffer_put_string(m, out.value, out.length); buffer_put_int(m, flags); - mm_request_send(socket, MONITOR_ANS_GSSSTEP, m); + mm_request_send(sock, MONITOR_ANS_GSSSTEP, m); gss_release_buffer(&minor, &out); @@ -1804,7 +1810,7 @@ mm_answer_gss_accept_ctx(int socket, Buffer *m) } int -mm_answer_gss_checkmic(int socket, Buffer *m) +mm_answer_gss_checkmic(int sock, Buffer *m) { gss_buffer_desc gssbuf, mic; OM_uint32 ret; @@ -1823,7 +1829,7 @@ mm_answer_gss_checkmic(int socket, Buffer *m) buffer_clear(m); buffer_put_int(m, ret); - mm_request_send(socket, MONITOR_ANS_GSSCHECKMIC, m); + mm_request_send(sock, MONITOR_ANS_GSSCHECKMIC, m); if (!GSS_ERROR(ret)) monitor_permit(mon_dispatch, MONITOR_REQ_GSSUSEROK, 1); @@ -1832,7 +1838,7 @@ mm_answer_gss_checkmic(int socket, Buffer *m) } int -mm_answer_gss_userok(int socket, Buffer *m) +mm_answer_gss_userok(int sock, Buffer *m) { int authenticated; @@ -1842,7 +1848,7 @@ mm_answer_gss_userok(int socket, Buffer *m) buffer_put_int(m, authenticated); debug3("%s: sending result %d", __func__, authenticated); - mm_request_send(socket, MONITOR_ANS_GSSUSEROK, m); + mm_request_send(sock, MONITOR_ANS_GSSUSEROK, m); auth_method="gssapi-with-mic"; diff --git a/crypto/openssh/monitor_wrap.c b/crypto/openssh/monitor_wrap.c index b4f2a89..dab175a 100644 --- a/crypto/openssh/monitor_wrap.c +++ b/crypto/openssh/monitor_wrap.c @@ -25,7 +25,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: monitor_wrap.c,v 1.35 2003/11/17 11:06:07 markus Exp $"); +RCSID("$OpenBSD: monitor_wrap.c,v 1.39 2004/07/17 05:31:41 dtucker Exp $"); RCSID("$FreeBSD$"); #include <openssl/bn.h> @@ -71,6 +71,7 @@ extern z_stream incoming_stream; extern z_stream outgoing_stream; extern struct monitor *pmonitor; extern Buffer input, output; +extern Buffer loginmsg; extern ServerOptions options; int @@ -84,7 +85,7 @@ mm_is_monitor(void) } void -mm_request_send(int socket, enum monitor_reqtype type, Buffer *m) +mm_request_send(int sock, enum monitor_reqtype type, Buffer *m) { u_int mlen = buffer_len(m); u_char buf[5]; @@ -93,14 +94,14 @@ mm_request_send(int socket, enum monitor_reqtype type, Buffer *m) PUT_32BIT(buf, mlen + 1); buf[4] = (u_char) type; /* 1st byte of payload is mesg-type */ - if (atomicio(vwrite, socket, buf, sizeof(buf)) != sizeof(buf)) + if (atomicio(vwrite, sock, buf, sizeof(buf)) != sizeof(buf)) fatal("%s: write", __func__); - if (atomicio(vwrite, socket, buffer_ptr(m), mlen) != mlen) + if (atomicio(vwrite, sock, buffer_ptr(m), mlen) != mlen) fatal("%s: write", __func__); } void -mm_request_receive(int socket, Buffer *m) +mm_request_receive(int sock, Buffer *m) { u_char buf[4]; u_int msg_len; @@ -108,7 +109,7 @@ mm_request_receive(int socket, Buffer *m) debug3("%s entering", __func__); - res = atomicio(read, socket, buf, sizeof(buf)); + res = atomicio(read, sock, buf, sizeof(buf)); if (res != sizeof(buf)) { if (res == 0) cleanup_exit(255); @@ -119,19 +120,19 @@ mm_request_receive(int socket, Buffer *m) fatal("%s: read: bad msg_len %d", __func__, msg_len); buffer_clear(m); buffer_append_space(m, msg_len); - res = atomicio(read, socket, buffer_ptr(m), msg_len); + res = atomicio(read, sock, buffer_ptr(m), msg_len); if (res != msg_len) fatal("%s: read: %ld != msg_len", __func__, (long)res); } void -mm_request_receive_expect(int socket, enum monitor_reqtype type, Buffer *m) +mm_request_receive_expect(int sock, enum monitor_reqtype type, Buffer *m) { u_char rtype; debug3("%s entering: type %d", __func__, type); - mm_request_receive(socket, m); + mm_request_receive(sock, m); rtype = buffer_get_char(m); if (rtype != type) fatal("%s: read: rtype %d != type %d", __func__, @@ -195,7 +196,7 @@ mm_key_sign(Key *key, u_char **sigp, u_int *lenp, u_char *data, u_int datalen) } struct passwd * -mm_getpwnamallow(const char *login) +mm_getpwnamallow(const char *username) { Buffer m; struct passwd *pw; @@ -204,7 +205,7 @@ mm_getpwnamallow(const char *login) debug3("%s entering", __func__); buffer_init(&m); - buffer_put_cstring(&m, login); + buffer_put_cstring(&m, username); mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PWNAM, &m); @@ -545,7 +546,7 @@ mm_send_kex(Buffer *m, Kex *kex) } void -mm_send_keystate(struct monitor *pmonitor) +mm_send_keystate(struct monitor *monitor) { Buffer m; u_char *blob, *p; @@ -581,7 +582,7 @@ mm_send_keystate(struct monitor *pmonitor) goto skip; } else { /* Kex for rekeying */ - mm_send_kex(&m, *pmonitor->m_pkex); + mm_send_kex(&m, *monitor->m_pkex); } debug3("%s: Sending new keys: %p %p", @@ -633,7 +634,7 @@ mm_send_keystate(struct monitor *pmonitor) buffer_put_string(&m, buffer_ptr(&input), buffer_len(&input)); buffer_put_string(&m, buffer_ptr(&output), buffer_len(&output)); - mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_KEYEXPORT, &m); + mm_request_send(monitor->m_recvfd, MONITOR_REQ_KEYEXPORT, &m); debug3("%s: Finished sending state", __func__); buffer_free(&m); @@ -643,7 +644,7 @@ int mm_pty_allocate(int *ptyfd, int *ttyfd, char *namebuf, int namebuflen) { Buffer m; - char *p; + char *p, *msg; int success = 0; buffer_init(&m); @@ -659,11 +660,15 @@ mm_pty_allocate(int *ptyfd, int *ttyfd, char *namebuf, int namebuflen) return (0); } p = buffer_get_string(&m, NULL); + msg = buffer_get_string(&m, NULL); buffer_free(&m); strlcpy(namebuf, p, namebuflen); /* Possible truncation */ xfree(p); + buffer_append(&loginmsg, msg, strlen(msg)); + xfree(msg); + *ptyfd = mm_receive_fd(pmonitor->m_recvfd); *ttyfd = mm_receive_fd(pmonitor->m_recvfd); @@ -979,7 +984,7 @@ mm_skey_respond(void *ctx, u_int numresponses, char **responses) return ((authok == 0) ? -1 : 0); } -#endif +#endif /* SKEY */ void mm_ssh1_session_id(u_char session_id[16]) @@ -1096,7 +1101,7 @@ mm_auth_rsa_verify_response(Key *key, BIGNUM *p, u_char response[16]) #ifdef GSSAPI OM_uint32 -mm_ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID oid) +mm_ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID goid) { Buffer m; OM_uint32 major; @@ -1105,7 +1110,7 @@ mm_ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID oid) *ctx = NULL; buffer_init(&m); - buffer_put_string(&m, oid->elements, oid->length); + buffer_put_string(&m, goid->elements, goid->length); mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSSETUP, &m); mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSSETUP, &m); diff --git a/crypto/openssh/monitor_wrap.h b/crypto/openssh/monitor_wrap.h index a7c9edd..1f24d56 100644 --- a/crypto/openssh/monitor_wrap.h +++ b/crypto/openssh/monitor_wrap.h @@ -1,4 +1,4 @@ -/* $OpenBSD: monitor_wrap.h,v 1.13 2003/11/17 11:06:07 markus Exp $ */ +/* $OpenBSD: monitor_wrap.h,v 1.14 2004/06/21 17:36:31 avsm Exp $ */ /* $FreeBSD$ */ /* @@ -59,9 +59,9 @@ BIGNUM *mm_auth_rsa_generate_challenge(Key *); #ifdef GSSAPI #include "ssh-gss.h" -OM_uint32 mm_ssh_gssapi_server_ctx(Gssctxt **ctxt, gss_OID oid); -OM_uint32 mm_ssh_gssapi_accept_ctx(Gssctxt *ctxt, - gss_buffer_desc *recv, gss_buffer_desc *send, OM_uint32 *flags); +OM_uint32 mm_ssh_gssapi_server_ctx(Gssctxt **, gss_OID); +OM_uint32 mm_ssh_gssapi_accept_ctx(Gssctxt *, + gss_buffer_desc *, gss_buffer_desc *, OM_uint32 *); int mm_ssh_gssapi_userok(char *user); OM_uint32 mm_ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t); #endif diff --git a/crypto/openssh/myproposal.h b/crypto/openssh/myproposal.h index 065dd44..61f612a 100644 --- a/crypto/openssh/myproposal.h +++ b/crypto/openssh/myproposal.h @@ -1,4 +1,4 @@ -/* $OpenBSD: myproposal.h,v 1.15 2003/05/17 04:27:52 markus Exp $ */ +/* $OpenBSD: myproposal.h,v 1.16 2004/06/13 12:53:24 djm Exp $ */ /* $FreeBSD$ */ /* @@ -24,7 +24,9 @@ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ -#define KEX_DEFAULT_KEX "diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1" +#define KEX_DEFAULT_KEX "diffie-hellman-group-exchange-sha1," \ + "diffie-hellman-group14-sha1," \ + "diffie-hellman-group1-sha1" #define KEX_DEFAULT_PK_ALG "ssh-dss,ssh-rsa" #define KEX_DEFAULT_ENCRYPT \ "aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour," \ diff --git a/crypto/openssh/openbsd-compat/fake-rfc2553.h b/crypto/openssh/openbsd-compat/fake-rfc2553.h index a19a42f..44e146d 100644 --- a/crypto/openssh/openbsd-compat/fake-rfc2553.h +++ b/crypto/openssh/openbsd-compat/fake-rfc2553.h @@ -1,5 +1,5 @@ -/* $FreeBSD$ */ /* $Id: fake-rfc2553.h,v 1.8 2004/02/10 02:05:41 dtucker Exp $ */ +/* $FreeBSD$ */ /* * Copyright (C) 2000-2003 Damien Miller. All rights reserved. diff --git a/crypto/openssh/packet.h b/crypto/openssh/packet.h index 7732faf..37f82f2 100644 --- a/crypto/openssh/packet.h +++ b/crypto/openssh/packet.h @@ -1,4 +1,4 @@ -/* $OpenBSD: packet.h,v 1.40 2003/06/24 08:23:46 markus Exp $ */ +/* $OpenBSD: packet.h,v 1.41 2004/05/11 19:01:43 deraadt Exp $ */ /* * Author: Tatu Ylonen <ylo@cs.hut.fi> @@ -82,7 +82,7 @@ void tty_make_modes(int, struct termios *); void tty_parse_modes(int, int *); extern u_int max_packet_size; -u_int packet_set_maxsize(u_int); +int packet_set_maxsize(u_int); #define packet_get_maxsize() max_packet_size /* don't allow remaining bytes after the end of the message */ diff --git a/crypto/openssh/pathnames.h b/crypto/openssh/pathnames.h index 53208cf..cf42625 100644 --- a/crypto/openssh/pathnames.h +++ b/crypto/openssh/pathnames.h @@ -1,4 +1,4 @@ -/* $OpenBSD: pathnames.h,v 1.14 2004/01/30 09:48:57 markus Exp $ */ +/* $OpenBSD: pathnames.h,v 1.15 2004/07/11 17:48:47 deraadt Exp $ */ /* * Author: Tatu Ylonen <ylo@cs.hut.fi> @@ -122,7 +122,7 @@ /* Location of ssh-keysign for hostbased authentication */ #ifndef _PATH_SSH_KEY_SIGN -#define _PATH_SSH_KEY_SIGN "/usr/libexec/ssh-keysign" +#define _PATH_SSH_KEY_SIGN "/usr/libexec/ssh-keysign" #endif /* xauth for X11 forwarding */ diff --git a/crypto/openssh/readconf.c b/crypto/openssh/readconf.c index c62b943..5a5813a 100644 --- a/crypto/openssh/readconf.c +++ b/crypto/openssh/readconf.c @@ -12,8 +12,8 @@ */ #include "includes.h" +RCSID("$OpenBSD: readconf.c,v 1.134 2004/07/11 17:48:47 deraadt Exp $"); RCSID("$FreeBSD$"); -RCSID("$OpenBSD: readconf.c,v 1.127 2003/12/16 15:49:51 markus Exp $"); #include "ssh.h" #include "xmalloc.h" @@ -107,6 +107,7 @@ typedef enum { oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout, oAddressFamily, oGssAuthentication, oGssDelegateCreds, oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly, + oSendEnv, oControlPath, oControlMaster, oVersionAddendum, oDeprecated, oUnsupported } OpCodes; @@ -195,6 +196,9 @@ static struct { { "addressfamily", oAddressFamily }, { "serveraliveinterval", oServerAliveInterval }, { "serveralivecountmax", oServerAliveCountMax }, + { "sendenv", oSendEnv }, + { "controlpath", oControlPath }, + { "controlmaster", oControlMaster }, { "versionaddendum", oVersionAddendum }, { NULL, oBadOption } }; @@ -752,6 +756,27 @@ parse_int: intptr = &options->server_alive_count_max; goto parse_int; + case oSendEnv: + while ((arg = strdelim(&s)) != NULL && *arg != '\0') { + if (strchr(arg, '=') != NULL) + fatal("%s line %d: Invalid environment name.", + filename, linenum); + if (options->num_send_env >= MAX_SEND_ENV) + fatal("%s line %d: too many send env.", + filename, linenum); + options->send_env[options->num_send_env++] = + xstrdup(arg); + } + break; + + case oControlPath: + charptr = &options->control_path; + goto parse_string; + + case oControlMaster: + intptr = &options->control_master; + goto parse_yesnoask; + case oVersionAddendum: ssh_version_set_addendum(strtok(s, "\n")); do { @@ -789,7 +814,8 @@ parse_int: */ int -read_config_file(const char *filename, const char *host, Options *options) +read_config_file(const char *filename, const char *host, Options *options, + int checkperm) { FILE *f; char line[1024]; @@ -797,10 +823,19 @@ read_config_file(const char *filename, const char *host, Options *options) int bad_options = 0; /* Open the file. */ - f = fopen(filename, "r"); - if (!f) + if ((f = fopen(filename, "r")) == NULL) return 0; + if (checkperm) { + struct stat sb; + + if (fstat(fileno(f), &sb) == -1) + fatal("fstat %s: %s", filename, strerror(errno)); + if (((sb.st_uid != 0 && sb.st_uid != getuid()) || + (sb.st_mode & 022) != 0)) + fatal("Bad owner or permissions on %s", filename); + } + debug("Reading configuration data %.200s", filename); /* @@ -889,6 +924,9 @@ initialize_options(Options * options) options->verify_host_key_dns = -1; options->server_alive_interval = -1; options->server_alive_count_max = -1; + options->num_send_env = 0; + options->control_path = NULL; + options->control_master = -1; } /* @@ -1009,6 +1047,8 @@ fill_default_options(Options * options) options->server_alive_interval = 0; if (options->server_alive_count_max == -1) options->server_alive_count_max = 3; + if (options->control_master == -1) + options->control_master = 0; /* options->proxy_command should not be set by default */ /* options->user will be set in the main program if appropriate */ /* options->hostname will be set in the main program if appropriate */ diff --git a/crypto/openssh/readconf.h b/crypto/openssh/readconf.h index 93d833c..ded4225 100644 --- a/crypto/openssh/readconf.h +++ b/crypto/openssh/readconf.h @@ -1,4 +1,4 @@ -/* $OpenBSD: readconf.h,v 1.60 2004/03/05 10:53:58 markus Exp $ */ +/* $OpenBSD: readconf.h,v 1.64 2004/07/11 17:48:47 deraadt Exp $ */ /* * Author: Tatu Ylonen <ylo@cs.hut.fi> @@ -27,6 +27,8 @@ typedef struct { } Forward; /* Data structure for representing option data. */ +#define MAX_SEND_ENV 256 + typedef struct { int forward_agent; /* Forward authentication agent. */ int forward_x11; /* Forward X11 display. */ @@ -101,14 +103,20 @@ typedef struct { int rekey_limit; int no_host_authentication_for_localhost; int identities_only; - int server_alive_interval; + int server_alive_interval; int server_alive_count_max; + + int num_send_env; + char *send_env[MAX_SEND_ENV]; + + char *control_path; + int control_master; } Options; void initialize_options(Options *); void fill_default_options(Options *); -int read_config_file(const char *, const char *, Options *); +int read_config_file(const char *, const char *, Options *, int); int process_config_line(Options *, const char *, char *, const char *, int, int *); diff --git a/crypto/openssh/readpass.h b/crypto/openssh/readpass.h deleted file mode 100644 index a45d32f..0000000 --- a/crypto/openssh/readpass.h +++ /dev/null @@ -1,19 +0,0 @@ -/* $OpenBSD: readpass.h,v 1.7 2002/03/26 15:58:46 markus Exp $ */ - -/* - * Author: Tatu Ylonen <ylo@cs.hut.fi> - * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland - * All rights reserved - * - * As far as I am concerned, the code I have written for this software - * can be used freely for any purpose. Any derived versions of this - * software must be clearly marked as such, and if the derived work is - * incompatible with the protocol description in the RFC file, it must be - * called by a name other than "ssh" or "Secure Shell". - */ - -#define RP_ECHO 0x0001 -#define RP_ALLOW_STDIN 0x0002 -#define RP_ALLOW_EOF 0x0004 - -char *read_passphrase(const char *, int); diff --git a/crypto/openssh/rijndael.c b/crypto/openssh/rijndael.c index 1cd24de..7432ea2 100644 --- a/crypto/openssh/rijndael.c +++ b/crypto/openssh/rijndael.c @@ -1,4 +1,4 @@ -/* $OpenBSD: rijndael.c,v 1.15 2003/11/21 11:57:03 djm Exp $ */ +/* $OpenBSD: rijndael.c,v 1.16 2004/06/23 00:39:38 mouring Exp $ */ /** * rijndael-alg-fst.c @@ -1218,10 +1218,10 @@ static void rijndaelDecrypt(const u32 rk[/*4*(Nr + 1)*/], int Nr, const u8 ct[16 } void -rijndael_set_key(rijndael_ctx *ctx, u_char *key, int bits, int encrypt) +rijndael_set_key(rijndael_ctx *ctx, u_char *key, int bits, int do_encrypt) { ctx->Nr = rijndaelKeySetupEnc(ctx->ek, key, bits); - if (encrypt) { + if (do_encrypt) { ctx->decrypt = 0; memset(ctx->dk, 0, sizeof(ctx->dk)); } else { diff --git a/crypto/openssh/scp.c b/crypto/openssh/scp.c index 1daa2cc..ef9eaa1 100644 --- a/crypto/openssh/scp.c +++ b/crypto/openssh/scp.c @@ -71,7 +71,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: scp.c,v 1.113 2003/11/23 23:21:21 djm Exp $"); +RCSID("$OpenBSD: scp.c,v 1.117 2004/08/11 21:44:32 avsm Exp $"); #include "xmalloc.h" #include "atomicio.h" @@ -80,11 +80,7 @@ RCSID("$OpenBSD: scp.c,v 1.113 2003/11/23 23:21:21 djm Exp $"); #include "misc.h" #include "progressmeter.h" -#ifdef HAVE___PROGNAME extern char *__progname; -#else -char *__progname; -#endif void bwlimit(int); @@ -663,7 +659,7 @@ bwlimit(int amount) { static struct timeval bwstart, bwend; static int lamt, thresh = 16384; - u_int64_t wait; + u_int64_t waitlen; struct timespec ts, rm; if (!timerisset(&bwstart)) { @@ -681,10 +677,10 @@ bwlimit(int amount) return; lamt *= 8; - wait = (double)1000000L * lamt / limit_rate; + waitlen = (double)1000000L * lamt / limit_rate; - bwstart.tv_sec = wait / 1000000L; - bwstart.tv_usec = wait % 1000000L; + bwstart.tv_sec = waitlen / 1000000L; + bwstart.tv_usec = waitlen % 1000000L; if (timercmp(&bwstart, &bwend, >)) { timersub(&bwstart, &bwend, &bwend); @@ -759,6 +755,8 @@ sink(int argc, char **argv) *cp++ = ch; } while (cp < &buf[sizeof(buf) - 1] && ch != '\n'); *cp = 0; + if (verbose_mode) + fprintf(stderr, "Sink: %s", buf); if (buf[0] == '\01' || buf[0] == '\02') { if (iamremote == 0) @@ -822,6 +820,10 @@ sink(int argc, char **argv) size = size * 10 + (*cp++ - '0'); if (*cp++ != ' ') SCREWUP("size not delimited"); + if ((strchr(cp, '/') != NULL) || (strcmp(cp, "..") == 0)) { + run_err("error: unexpected filename: %s", cp); + exit(1); + } if (targisdir) { static char *namebuf; static int cursize; @@ -843,6 +845,8 @@ sink(int argc, char **argv) exists = stat(np, &stb) == 0; if (buf[0] == 'D') { int mod_flag = pflag; + if (!iamrecursive) + SCREWUP("received directory without -r"); if (exists) { if (!S_ISDIR(stb.st_mode)) { errno = ENOTDIR; @@ -894,11 +898,8 @@ bad: run_err("%s: %s", np, strerror(errno)); amt = size - i; count += amt; do { - j = read(remin, cp, amt); - if (j == -1 && (errno == EINTR || - errno == EAGAIN)) { - continue; - } else if (j <= 0) { + j = atomicio(read, remin, cp, amt); + if (j <= 0) { run_err("%s", j ? strerror(errno) : "dropped connection"); exit(1); @@ -938,21 +939,25 @@ bad: run_err("%s: %s", np, strerror(errno)); if (pflag) { if (exists || omode != mode) #ifdef HAVE_FCHMOD - if (fchmod(ofd, omode)) + if (fchmod(ofd, omode)) { #else /* HAVE_FCHMOD */ - if (chmod(np, omode)) + if (chmod(np, omode)) { #endif /* HAVE_FCHMOD */ run_err("%s: set mode: %s", np, strerror(errno)); + wrerr = DISPLAYED; + } } else { if (!exists && omode != mode) #ifdef HAVE_FCHMOD - if (fchmod(ofd, omode & ~mask)) + if (fchmod(ofd, omode & ~mask)) { #else /* HAVE_FCHMOD */ - if (chmod(np, omode & ~mask)) + if (chmod(np, omode & ~mask)) { #endif /* HAVE_FCHMOD */ run_err("%s: set mode: %s", np, strerror(errno)); + wrerr = DISPLAYED; + } } if (close(ofd) == -1) { wrerr = YES; diff --git a/crypto/openssh/servconf.c b/crypto/openssh/servconf.c index 2afd6eb..83479c1 100644 --- a/crypto/openssh/servconf.c +++ b/crypto/openssh/servconf.c @@ -10,7 +10,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: servconf.c,v 1.130 2003/12/23 16:12:10 jakob Exp $"); +RCSID("$OpenBSD: servconf.c,v 1.137 2004/08/13 11:09:24 dtucker Exp $"); RCSID("$FreeBSD$"); #include "ssh.h" @@ -19,7 +19,6 @@ RCSID("$FreeBSD$"); #include "xmalloc.h" #include "compat.h" #include "pathnames.h" -#include "tildexpand.h" #include "misc.h" #include "cipher.h" #include "kex.h" @@ -96,12 +95,14 @@ initialize_server_options(ServerOptions *options) options->max_startups_begin = -1; options->max_startups_rate = -1; options->max_startups = -1; + options->max_authtries = -1; options->banner = NULL; options->use_dns = -1; options->client_alive_interval = -1; options->client_alive_count_max = -1; options->authorized_keys_file = NULL; options->authorized_keys_file2 = NULL; + options->num_accept_env = 0; /* Needs to be accessable in many places */ use_privsep = -1; @@ -215,6 +216,8 @@ fill_default_server_options(ServerOptions *options) options->max_startups_rate = 100; /* 100% */ if (options->max_startups_begin == -1) options->max_startups_begin = options->max_startups; + if (options->max_authtries == -1) + options->max_authtries = DEFAULT_AUTH_FAIL_MAX; if (options->use_dns == -1) options->use_dns = 1; if (options->client_alive_interval == -1) @@ -265,11 +268,12 @@ typedef enum { sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression, sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups, sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile, - sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem, sMaxStartups, + sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem, + sMaxStartups, sMaxAuthTries, sBanner, sUseDNS, sHostbasedAuthentication, sHostbasedUsesNameFromPacketOnly, sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2, - sGssAuthentication, sGssCleanupCreds, + sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sUsePrivilegeSeparation, sVersionAddendum, sDeprecated, sUnsupported @@ -361,6 +365,7 @@ static struct { { "gatewayports", sGatewayPorts }, { "subsystem", sSubsystem }, { "maxstartups", sMaxStartups }, + { "maxauthtries", sMaxAuthTries }, { "banner", sBanner }, { "usedns", sUseDNS }, { "verifyreversemapping", sDeprecated }, @@ -370,6 +375,7 @@ static struct { { "authorizedkeysfile", sAuthorizedKeysFile }, { "authorizedkeysfile2", sAuthorizedKeysFile2 }, { "useprivilegeseparation", sUsePrivilegeSeparation}, + { "acceptenv", sAcceptEnv }, { "versionaddendum", sVersionAddendum }, { NULL, sBadOption } }; @@ -873,6 +879,10 @@ parse_flag: options->max_startups = options->max_startups_begin; break; + case sMaxAuthTries: + intptr = &options->max_authtries; + goto parse_int; + case sBanner: charptr = &options->banner; goto parse_filename; @@ -897,6 +907,19 @@ parse_flag: intptr = &options->client_alive_count_max; goto parse_int; + case sAcceptEnv: + while ((arg = strdelim(&cp)) && *arg != '\0') { + if (strchr(arg, '=') != NULL) + fatal("%s line %d: Invalid environment name.", + filename, linenum); + if (options->num_accept_env >= MAX_ACCEPT_ENV) + fatal("%s line %d: too many allow env.", + filename, linenum); + options->accept_env[options->num_accept_env++] = + xstrdup(arg); + } + break; + case sVersionAddendum: ssh_version_set_addendum(strtok(cp, "\n")); do { @@ -931,26 +954,50 @@ parse_flag: /* Reads the server configuration file. */ void -read_server_config(ServerOptions *options, const char *filename) +load_server_config(const char *filename, Buffer *conf) { - int linenum, bad_options = 0; - char line[1024]; + char line[1024], *cp; FILE *f; - debug2("read_server_config: filename %s", filename); - f = fopen(filename, "r"); - if (!f) { + debug2("%s: filename %s", __func__, filename); + if ((f = fopen(filename, "r")) == NULL) { perror(filename); exit(1); } - linenum = 0; + buffer_clear(conf); while (fgets(line, sizeof(line), f)) { - /* Update line number counter. */ - linenum++; - if (process_server_config_line(options, line, filename, linenum) != 0) - bad_options++; + /* + * Trim out comments and strip whitespace + * NB - preserve newlines, they are needed to reproduce + * line numbers later for error messages + */ + if ((cp = strchr(line, '#')) != NULL) + memcpy(cp, "\n", 2); + cp = line + strspn(line, " \t\r"); + + buffer_append(conf, cp, strlen(cp)); } + buffer_append(conf, "\0", 1); fclose(f); + debug2("%s: done config len = %d", __func__, buffer_len(conf)); +} + +void +parse_server_config(ServerOptions *options, const char *filename, Buffer *conf) +{ + int linenum, bad_options = 0; + char *cp, *obuf, *cbuf; + + debug2("%s: config %s len %d", __func__, filename, buffer_len(conf)); + + obuf = cbuf = xstrdup(buffer_ptr(conf)); + linenum = 1; + while((cp = strsep(&cbuf, "\n")) != NULL) { + if (process_server_config_line(options, cp, filename, + linenum++) != 0) + bad_options++; + } + xfree(obuf); if (bad_options > 0) fatal("%s: terminating, %d bad configuration options", filename, bad_options); diff --git a/crypto/openssh/servconf.h b/crypto/openssh/servconf.h index 7b1ba7f..8286342 100644 --- a/crypto/openssh/servconf.h +++ b/crypto/openssh/servconf.h @@ -1,4 +1,4 @@ -/* $OpenBSD: servconf.h,v 1.67 2003/12/23 16:12:10 jakob Exp $ */ +/* $OpenBSD: servconf.h,v 1.70 2004/06/24 19:30:54 djm Exp $ */ /* $FreeBSD$ */ /* @@ -17,6 +17,8 @@ #ifndef SERVCONF_H #define SERVCONF_H +#include "buffer.h" + #define MAX_PORTS 256 /* Max # ports. */ #define MAX_ALLOW_USERS 256 /* Max # users on allow list. */ @@ -25,6 +27,7 @@ #define MAX_DENY_GROUPS 256 /* Max # groups on deny list. */ #define MAX_SUBSYSTEMS 256 /* Max # subsystems. */ #define MAX_HOSTKEYS 256 /* Max # hostkeys. */ +#define MAX_ACCEPT_ENV 256 /* Max # of env vars. */ /* permit_root_login */ #define PERMIT_NOT_SET -1 @@ -33,6 +36,7 @@ #define PERMIT_NO_PASSWD 2 #define PERMIT_YES 3 +#define DEFAULT_AUTH_FAIL_MAX 6 /* Default for MaxAuthTries */ typedef struct { u_int num_ports; @@ -108,9 +112,13 @@ typedef struct { char *subsystem_name[MAX_SUBSYSTEMS]; char *subsystem_command[MAX_SUBSYSTEMS]; + u_int num_accept_env; + char *accept_env[MAX_ACCEPT_ENV]; + int max_startups_begin; int max_startups_rate; int max_startups; + int max_authtries; char *banner; /* SSH-2 banner message */ int use_dns; int client_alive_interval; /* @@ -129,9 +137,9 @@ typedef struct { } ServerOptions; void initialize_server_options(ServerOptions *); -void read_server_config(ServerOptions *, const char *); void fill_default_server_options(ServerOptions *); int process_server_config_line(ServerOptions *, char *, const char *, int); - +void load_server_config(const char *, Buffer *); +void parse_server_config(ServerOptions *, const char *, Buffer *); #endif /* SERVCONF_H */ diff --git a/crypto/openssh/serverloop.c b/crypto/openssh/serverloop.c index a777a04..eee1e79 100644 --- a/crypto/openssh/serverloop.c +++ b/crypto/openssh/serverloop.c @@ -35,7 +35,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: serverloop.c,v 1.115 2004/01/19 21:25:15 markus Exp $"); +RCSID("$OpenBSD: serverloop.c,v 1.117 2004/08/11 21:43:05 avsm Exp $"); #include "xmalloc.h" #include "packet.h" @@ -240,7 +240,7 @@ client_alive_check(void) */ static void wait_until_can_do_something(fd_set **readsetp, fd_set **writesetp, int *maxfdp, - int *nallocp, u_int max_time_milliseconds) + u_int *nallocp, u_int max_time_milliseconds) { struct timeval tv, *tvp; int ret; @@ -486,7 +486,8 @@ void server_loop(pid_t pid, int fdin_arg, int fdout_arg, int fderr_arg) { fd_set *readset = NULL, *writeset = NULL; - int max_fd = 0, nalloc = 0; + int max_fd = 0; + u_int nalloc = 0; int wait_status; /* Status returned by wait(). */ pid_t wait_pid; /* pid returned by wait(). */ int waiting_termination = 0; /* Have displayed waiting close message. */ @@ -991,6 +992,17 @@ server_input_global_request(int type, u_int32_t seq, void *ctxt) listen_address, listen_port, options.gateway_ports); } xfree(listen_address); + } else if (strcmp(rtype, "cancel-tcpip-forward") == 0) { + char *cancel_address; + u_short cancel_port; + + cancel_address = packet_get_string(NULL); + cancel_port = (u_short)packet_get_int(); + debug("%s: cancel-tcpip-forward addr %s port %d", __func__, + cancel_address, cancel_port); + + success = channel_cancel_rport_listener(cancel_address, + cancel_port); } if (want_reply) { packet_start(success ? diff --git a/crypto/openssh/session.c b/crypto/openssh/session.c index 3f9049f..cbc8db1 100644 --- a/crypto/openssh/session.c +++ b/crypto/openssh/session.c @@ -33,7 +33,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: session.c,v 1.172 2004/01/30 09:48:57 markus Exp $"); +RCSID("$OpenBSD: session.c,v 1.180 2004/07/28 09:40:29 markus Exp $"); RCSID("$FreeBSD$"); #include "ssh.h" @@ -43,7 +43,7 @@ RCSID("$FreeBSD$"); #include "sshpty.h" #include "packet.h" #include "buffer.h" -#include "mpaux.h" +#include "match.h" #include "uidswap.h" #include "compat.h" #include "channels.h" @@ -197,12 +197,11 @@ auth_input_request_forwarding(struct passwd * pw) static void display_loginmsg(void) { - if (buffer_len(&loginmsg) > 0) { - buffer_append(&loginmsg, "\0", 1); - printf("%s\n", (char *)buffer_ptr(&loginmsg)); - buffer_clear(&loginmsg); - } - fflush(stdout); + if (buffer_len(&loginmsg) > 0) { + buffer_append(&loginmsg, "\0", 1); + printf("%s", (char *)buffer_ptr(&loginmsg)); + buffer_clear(&loginmsg); + } } void @@ -266,7 +265,7 @@ do_authenticated1(Authctxt *authctxt) compression_level = packet_get_int(); packet_check_eom(); if (compression_level < 1 || compression_level > 9) { - packet_send_debug("Received illegal compression level %d.", + packet_send_debug("Received invalid compression level %d.", compression_level); break; } @@ -482,7 +481,11 @@ do_exec_no_pty(Session *s, const char *command) close(perr[1]); if (compat20) { - session_set_fds(s, pin[1], pout[0], s->is_subsystem ? -1 : perr[0]); + if (s->is_subsystem) { + close(perr[0]); + perr[0] = -1; + } + session_set_fds(s, pin[1], pout[0], perr[0]); } else { /* Enter the interactive session. */ server_loop(pid, pin[1], pout[0], perr[0]); @@ -673,14 +676,19 @@ do_exec(Session *s, const char *command) do_exec_no_pty(s, command); original_command = NULL; -} + /* + * Clear loginmsg: it's the child's responsibility to display + * it to the user, otherwise multiple sessions may accumulate + * multiple copies of the login messages. + */ + buffer_clear(&loginmsg); +} /* administrative, login(1)-like work */ void do_login(Session *s, const char *command) { - char *time_string; socklen_t fromlen; struct sockaddr_storage from; struct passwd * pw = s->pw; @@ -725,19 +733,6 @@ do_login(Session *s, const char *command) display_loginmsg(); -#ifndef NO_SSH_LASTLOG - if (options.print_lastlog && s->last_login_time != 0) { - time_string = ctime(&s->last_login_time); - if (strchr(time_string, '\n')) - *strchr(time_string, '\n') = 0; - if (strcmp(s->hostname, "") == 0) - printf("Last login: %s\r\n", time_string); - else - printf("Last login: %s from %s\r\n", time_string, - s->hostname); - } -#endif /* NO_SSH_LASTLOG */ - do_motd(); } @@ -1022,6 +1017,10 @@ do_setup_env(Session *s, const char *shell) if (!options.use_login) { /* Set basic environment. */ + for (i = 0; i < s->num_env; i++) + child_set_env(&env, &envsize, s->env[i].name, + s->env[i].val); + child_set_env(&env, &envsize, "USER", pw->pw_name); child_set_env(&env, &envsize, "LOGNAME", pw->pw_name); #ifdef _AIX @@ -1341,9 +1340,10 @@ do_setusercontext(struct passwd *pw) static void do_pwchange(Session *s) { + fflush(NULL); fprintf(stderr, "WARNING: Your password has expired.\n"); if (s->ttyfd != -1) { - fprintf(stderr, + fprintf(stderr, "You must change your password now and login again!\n"); execl(_PATH_PASSWD_PROG, "passwd", (char *)NULL); perror("passwd"); @@ -1457,6 +1457,13 @@ do_child(Session *s, const char *command) #else /* HAVE_OSF_SIA */ do_nologin(pw); do_setusercontext(pw); + /* + * PAM session modules in do_setusercontext may have + * generated messages, so if this in an interactive + * login then display them too. + */ + if (command == NULL) + display_loginmsg(); #endif /* HAVE_OSF_SIA */ } @@ -1726,12 +1733,6 @@ session_pty_req(Session *s) packet_disconnect("Protocol error: you already have a pty."); return 0; } - /* Get the time and hostname when the user last logged in. */ - if (options.print_lastlog) { - s->hostname[0] = '\0'; - s->last_login_time = get_last_login_time(s->pw->pw_uid, - s->pw->pw_name, s->hostname, sizeof(s->hostname)); - } s->term = packet_get_string(&len); @@ -1858,9 +1859,8 @@ session_exec_req(Session *s) static int session_break_req(Session *s) { - u_int break_length; - break_length = packet_get_int(); /* ignored */ + packet_get_int(); /* ignored */ packet_check_eom(); if (s->ttyfd == -1 || @@ -1870,6 +1870,41 @@ session_break_req(Session *s) } static int +session_env_req(Session *s) +{ + char *name, *val; + u_int name_len, val_len, i; + + name = packet_get_string(&name_len); + val = packet_get_string(&val_len); + packet_check_eom(); + + /* Don't set too many environment variables */ + if (s->num_env > 128) { + debug2("Ignoring env request %s: too many env vars", name); + goto fail; + } + + for (i = 0; i < options.num_accept_env; i++) { + if (match_pattern(name, options.accept_env[i])) { + debug2("Setting env %d: %s=%s", s->num_env, name, val); + s->env = xrealloc(s->env, sizeof(*s->env) * + (s->num_env + 1)); + s->env[s->num_env].name = name; + s->env[s->num_env].val = val; + s->num_env++; + return (1); + } + } + debug2("Ignoring env request %s: disallowed name", name); + + fail: + xfree(name); + xfree(val); + return (0); +} + +static int session_auth_agent_req(Session *s) { static int called = 0; @@ -1916,13 +1951,16 @@ session_input_channel_req(Channel *c, const char *rtype) success = session_auth_agent_req(s); } else if (strcmp(rtype, "subsystem") == 0) { success = session_subsystem_req(s); - } else if (strcmp(rtype, "break") == 0) { - success = session_break_req(s); + } else if (strcmp(rtype, "env") == 0) { + success = session_env_req(s); } } if (strcmp(rtype, "window-change") == 0) { success = session_window_change_req(s); + } else if (strcmp(rtype, "break") == 0) { + success = session_break_req(s); } + return success; } @@ -2055,6 +2093,8 @@ session_exit_message(Session *s, int status) void session_close(Session *s) { + int i; + debug("session_close: session %d pid %ld", s->self, (long)s->pid); if (s->ttyfd != -1) session_pty_cleanup(s); @@ -2069,6 +2109,12 @@ session_close(Session *s) if (s->auth_proto) xfree(s->auth_proto); s->used = 0; + for (i = 0; i < s->num_env; i++) { + xfree(s->env[i].name); + xfree(s->env[i].val); + } + if (s->env != NULL) + xfree(s->env); session_proctitle(s); } diff --git a/crypto/openssh/session.h b/crypto/openssh/session.h index 405b8fe..48be507 100644 --- a/crypto/openssh/session.h +++ b/crypto/openssh/session.h @@ -1,4 +1,4 @@ -/* $OpenBSD: session.h,v 1.21 2003/09/23 20:17:11 markus Exp $ */ +/* $OpenBSD: session.h,v 1.23 2004/07/17 05:31:41 dtucker Exp $ */ /* * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. @@ -39,9 +39,6 @@ struct Session { int ptyfd, ttyfd, ptymaster; u_int row, col, xpixel, ypixel; char tty[TTYSZ]; - /* last login */ - char hostname[MAXHOSTNAMELEN]; - time_t last_login_time; /* X11 */ u_int display_number; char *display; @@ -53,6 +50,11 @@ struct Session { /* proto 2 */ int chanid; int is_subsystem; + int num_env; + struct { + char *name; + char *val; + } *env; }; void do_authenticated(Authctxt *); diff --git a/crypto/openssh/ssh-add.c b/crypto/openssh/ssh-add.c index e7699c9..06a5246 100644 --- a/crypto/openssh/ssh-add.c +++ b/crypto/openssh/ssh-add.c @@ -35,7 +35,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: ssh-add.c,v 1.69 2003/11/21 11:57:03 djm Exp $"); +RCSID("$OpenBSD: ssh-add.c,v 1.70 2004/05/08 00:21:31 djm Exp $"); #include <openssl/evp.h> @@ -47,15 +47,8 @@ RCSID("$OpenBSD: ssh-add.c,v 1.69 2003/11/21 11:57:03 djm Exp $"); #include "authfd.h" #include "authfile.h" #include "pathnames.h" -#include "readpass.h" #include "misc.h" -#ifdef HAVE___PROGNAME -extern char *__progname; -#else -char *__progname; -#endif - /* argv0 */ extern char *__progname; diff --git a/crypto/openssh/ssh-agent.c b/crypto/openssh/ssh-agent.c index 29aa7dd..22cf7e5 100644 --- a/crypto/openssh/ssh-agent.c +++ b/crypto/openssh/ssh-agent.c @@ -35,7 +35,7 @@ #include "includes.h" #include "openbsd-compat/sys-queue.h" -RCSID("$OpenBSD: ssh-agent.c,v 1.117 2003/12/02 17:01:15 markus Exp $"); +RCSID("$OpenBSD: ssh-agent.c,v 1.120 2004/08/11 21:43:05 avsm Exp $"); RCSID("$FreeBSD$"); #include <openssl/evp.h> @@ -51,7 +51,6 @@ RCSID("$FreeBSD$"); #include "authfd.h" #include "compat.h" #include "log.h" -#include "readpass.h" #include "misc.h" #ifdef SMARTCARD @@ -108,11 +107,7 @@ char socket_dir[1024]; int locked = 0; char *lock_passwd = NULL; -#ifdef HAVE___PROGNAME extern char *__progname; -#else -char *__progname; -#endif /* Default lifetime (0 == forever) */ static int lifetime = 0; @@ -791,8 +786,7 @@ new_socket(sock_type type, int fd) { u_int i, old_alloc, new_alloc; - if (fcntl(fd, F_SETFL, O_NONBLOCK) < 0) - error("fcntl O_NONBLOCK: %s", strerror(errno)); + set_nonblock(fd); if (fd > max_fd) max_fd = fd; @@ -823,7 +817,7 @@ new_socket(sock_type type, int fd) } static int -prepare_select(fd_set **fdrp, fd_set **fdwp, int *fdl, int *nallocp) +prepare_select(fd_set **fdrp, fd_set **fdwp, int *fdl, u_int *nallocp) { u_int i, sz; int n = 0; @@ -1009,7 +1003,8 @@ int main(int ac, char **av) { int c_flag = 0, d_flag = 0, k_flag = 0, s_flag = 0; - int sock, fd, ch, nalloc; + int sock, fd, ch; + u_int nalloc; char *shell, *format, *pidstr, *agentsocket = NULL; fd_set *readsetp = NULL, *writesetp = NULL; struct sockaddr_un sunaddr; diff --git a/crypto/openssh/ssh-keyscan.c b/crypto/openssh/ssh-keyscan.c index 266b23c..3cb52ac 100644 --- a/crypto/openssh/ssh-keyscan.c +++ b/crypto/openssh/ssh-keyscan.c @@ -7,7 +7,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: ssh-keyscan.c,v 1.47 2004/03/08 09:38:05 djm Exp $"); +RCSID("$OpenBSD: ssh-keyscan.c,v 1.50 2004/08/11 21:44:32 avsm Exp $"); #include "openbsd-compat/sys-queue.h" @@ -49,11 +49,7 @@ int timeout = 5; int maxfd; #define MAXCON (maxfd - 10) -#ifdef HAVE___PROGNAME extern char *__progname; -#else -char *__progname; -#endif fd_set *read_wait; size_t read_wait_size; int ncon; @@ -349,6 +345,7 @@ keygrab_ssh2(con *c) "ssh-dss": "ssh-rsa"; c->c_kex = kex_setup(myproposal); c->c_kex->kex[KEX_DH_GRP1_SHA1] = kexdh_client; + c->c_kex->kex[KEX_DH_GRP14_SHA1] = kexdh_client; c->c_kex->kex[KEX_DH_GEX_SHA1] = kexgex_client; c->c_kex->verify_host_key = hostjump; @@ -396,8 +393,8 @@ tcpconnect(char *host) error("socket: %s", strerror(errno)); continue; } - if (fcntl(s, F_SETFL, O_NONBLOCK) < 0) - fatal("F_SETFL: %s", strerror(errno)); + if (set_nonblock(s) == -1) + fatal("%s: set_nonblock(%d)", __func__, s); if (connect(s, ai->ai_addr, ai->ai_addrlen) < 0 && errno != EINPROGRESS) error("connect (`%s'): %s", host, strerror(errno)); @@ -497,7 +494,7 @@ congreet(int s) bufsiz = sizeof(buf); cp = buf; - while (bufsiz-- && (n = read(s, cp, 1)) == 1 && *cp != '\n') { + while (bufsiz-- && (n = atomicio(read, s, cp, 1)) == 1 && *cp != '\n') { if (*cp == '\r') *cp = '\n'; cp++; @@ -563,7 +560,7 @@ conread(int s) congreet(s); return; } - n = read(s, c->c_data + c->c_off, c->c_len - c->c_off); + n = atomicio(read, s, c->c_data + c->c_off, c->c_len - c->c_off); if (n < 0) { error("read (%s): %s", c->c_name, strerror(errno)); confree(s); diff --git a/crypto/openssh/ssh.1 b/crypto/openssh/ssh.1 index da812d6..4e5dbf1 100644 --- a/crypto/openssh/ssh.1 +++ b/crypto/openssh/ssh.1 @@ -34,8 +34,8 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" +.\" $OpenBSD: ssh.1,v 1.194 2004/08/12 21:41:13 jakob Exp $ .\" $FreeBSD$ -.\" $OpenBSD: ssh.1,v 1.181 2003/12/16 15:49:51 markus Exp $ .Dd September 25, 1999 .Dt SSH 1 .Os @@ -44,14 +44,14 @@ .Nd OpenSSH SSH client (remote login program) .Sh SYNOPSIS .Nm ssh -.Op Fl 1246AaCfgkNnqsTtVvXxY +.Op Fl 1246AaCfgkMNnqsTtVvXxY .Op Fl b Ar bind_address .Op Fl c Ar cipher_spec +.Bk -words .Op Fl D Ar port .Op Fl e Ar escape_char .Op Fl F Ar configfile .Op Fl i Ar identity_file -.Bk -words .Oo Fl L Xo .Sm off .Ar port : @@ -75,6 +75,7 @@ .Sm on .Xc .Oc +.Op Fl S Ar ctl .Oo Ar user Ns @ Oc Ns Ar hostname .Op Ar command .Sh DESCRIPTION @@ -242,8 +243,8 @@ Additionally, supports hostbased or challenge response authentication. .Pp Protocol 2 provides additional mechanisms for confidentiality -(the traffic is encrypted using 3DES, Blowfish, CAST128 or Arcfour) -and integrity (hmac-md5, hmac-sha1). +(the traffic is encrypted using AES, 3DES, Blowfish, CAST128 or Arcfour) +and integrity (hmac-md5, hmac-sha1, hmac-ripemd160). Note that protocol 1 lacks a strong mechanism for ensuring the integrity of the connection. .Ss Login session and remote execution @@ -303,11 +304,18 @@ Display a list of escape characters. Send a BREAK to the remote system (only useful for SSH protocol version 2 and if the peer supports it). .It Cm ~C -Open command line (only useful for adding port forwardings using the +Open command line. +Currently this allows the addition of port forwardings using the .Fl L and .Fl R -options). +options (see below). +It also allows the cancellation of existing remote port-forwardings +using +.Fl KR Ar hostport . +Basic help is available, using the +.Fl h +option. .It Cm ~R Request rekeying of the connection (only useful for SSH protocol version 2 and if the peer supports it). @@ -394,6 +402,15 @@ The option can be used to prevent logins to machines whose host key is not known or has changed. .Pp +.Nm +can be configured to verify host identification using fingerprint resource +records (SSHFP) published in DNS. +The +.Cm VerifyHostKeyDNS +option can be used to control how DNS lookups are performed. +SSHFP resource records can be generated using +.Xr ssh-keygen 1 . +.Pp The options are as follows: .Bl -tag -width Ds .It Fl 1 @@ -444,13 +461,18 @@ The default value can be set on a host-by-host basis in the configuration files; see the .Cm Compression option. -.It Fl c Ar blowfish | 3des | des -Selects the cipher to use for encrypting the session. -.Ar 3des -is used by default. -It is believed to be secure. +.It Fl c Ar cipher_spec +Selects the cipher specification for encrypting the session. +.Pp +Protocol version 1 allows specification of a single cipher. +The suported values are +.Dq 3des , +.Dq blowfish +and +.Dq des . .Ar 3des (triple-des) is an encrypt-decrypt-encrypt triple with three different keys. +It is believed to be secure. .Ar blowfish is a fast block cipher; it appears very secure and is much faster than .Ar 3des . @@ -462,12 +484,30 @@ that do not support the .Ar 3des cipher. Its use is strongly discouraged due to cryptographic weaknesses. -.It Fl c Ar cipher_spec -Additionally, for protocol version 2 a comma-separated list of ciphers can -be specified in order of preference. -See -.Cm Ciphers -for more information. +The default is +.Dq 3des . +.Pp +For protocol version 2 +.Ar cipher_spec +is a comma-separated list of ciphers +listed in order of preference. +The supported ciphers are +.Dq 3des-cbc , +.Dq aes128-cbc , +.Dq aes192-cbc , +.Dq aes256-cbc , +.Dq aes128-ctr , +.Dq aes192-ctr , +.Dq aes256-ctr , +.Dq arcfour , +.Dq blowfish-cbc , +and +.Dq cast128-cbc . +The default is +.Bd -literal + ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour, + aes192-cbc,aes256-cbc'' +.Ed .It Fl D Ar port Specifies a local .Dq dynamic @@ -570,6 +610,17 @@ IPv6 addresses can be specified with an alternative syntax: .It Fl l Ar login_name Specifies the user to log in as on the remote machine. This also may be specified on a per-host basis in the configuration file. +.It Fl M +Places the +.Nm +client into +.Dq master +mode for connection sharing. +Refer to the description of +.Cm ControlMaster +in +.Xr ssh_config 5 +for details. .It Fl m Ar mac_spec Additionally, for protocol version 2 a comma-separated list of MAC (message authentication code) algorithms can @@ -620,7 +671,9 @@ For full details of the options listed below, and their possible values, see .It Compression .It CompressionLevel .It ConnectionAttempts -.It ConnectionTimeout +.It ConnectTimeout +.It ControlMaster +.It ControlPath .It DynamicForward .It EscapeChar .It ForwardAgent @@ -651,6 +704,7 @@ For full details of the options listed below, and their possible values, see .It RemoteForward .It RhostsRSAAuthentication .It RSAAuthentication +.It SendEnv .It ServerAliveInterval .It ServerAliveCountMax .It SmartcardDevice @@ -695,6 +749,15 @@ IPv6 addresses can be specified with an alternative syntax: .Ar hostport . .Xc .Sm on +.It Fl S Ar ctl +Specifies the location of a control socket for connection sharing. +Refer to the description of +.Cm ControlPath +and +.Cm ControlMaster +in +.Xr ssh_config 5 +for details. .It Fl s May be used to request invocation of a subsystem on the remote system. Subsystems are a feature of the SSH2 protocol which facilitate the use @@ -887,6 +950,8 @@ the convenience of the user. This is the per-user configuration file. The file format and configuration options are described in .Xr ssh_config 5 . +Because of the potential for abuse, this file must have strict permissions: +read/write for the user, and not accessible by others. .It Pa $HOME/.ssh/authorized_keys Lists the public keys (RSA/DSA) that can be used for logging in as this user. The format of this file is described in the diff --git a/crypto/openssh/ssh.c b/crypto/openssh/ssh.c index d4535b8..0952f51a 100644 --- a/crypto/openssh/ssh.c +++ b/crypto/openssh/ssh.c @@ -40,8 +40,8 @@ */ #include "includes.h" +RCSID("$OpenBSD: ssh.c,v 1.224 2004/07/28 09:40:29 markus Exp $"); RCSID("$FreeBSD$"); -RCSID("$OpenBSD: ssh.c,v 1.206 2003/12/16 15:49:51 markus Exp $"); #include <openssl/evp.h> #include <openssl/err.h> @@ -54,31 +54,31 @@ RCSID("$OpenBSD: ssh.c,v 1.206 2003/12/16 15:49:51 markus Exp $"); #include "xmalloc.h" #include "packet.h" #include "buffer.h" +#include "bufaux.h" #include "channels.h" #include "key.h" #include "authfd.h" #include "authfile.h" #include "pathnames.h" +#include "dispatch.h" #include "clientloop.h" #include "log.h" #include "readconf.h" #include "sshconnect.h" -#include "tildexpand.h" -#include "dispatch.h" #include "misc.h" #include "kex.h" #include "mac.h" -#include "sshtty.h" +#include "sshpty.h" +#include "match.h" +#include "msg.h" +#include "monitor_fdpass.h" +#include "uidswap.h" #ifdef SMARTCARD #include "scard.h" #endif -#ifdef HAVE___PROGNAME extern char *__progname; -#else -char *__progname; -#endif /* Flag indicating whether debug mode is on. This can be set on the command line. */ int debug_flag = 0; @@ -142,16 +142,23 @@ static int client_global_request_id = 0; /* pid of proxycommand child process */ pid_t proxy_command_pid = 0; +/* fd to control socket */ +int control_fd = -1; + +/* Only used in control client mode */ +volatile sig_atomic_t control_client_terminate = 0; +u_int control_server_pid = 0; + /* Prints a help message to the user. This function never returns. */ static void usage(void) { fprintf(stderr, -"usage: ssh [-1246AaCfghkNnqsTtVvXxY] [-b bind_address] [-c cipher_spec]\n" +"usage: ssh [-1246AaCfghkMNnqsTtVvXxY] [-b bind_address] [-c cipher_spec]\n" " [-D port] [-e escape_char] [-F configfile] [-i identity_file]\n" " [-L port:host:hostport] [-l login_name] [-m mac_spec] [-o option]\n" -" [-p port] [-R port:host:hostport] [user@]hostname [command]\n" +" [-p port] [-R port:host:hostport] [-S ctl] [user@]hostname [command]\n" ); exit(1); } @@ -159,6 +166,7 @@ usage(void) static int ssh_session(void); static int ssh_session2(void); static void load_public_identity_files(void); +static void control_client(const char *path); /* * Main program for the ssh client. @@ -229,7 +237,7 @@ main(int ac, char **av) again: while ((opt = getopt(ac, av, - "1246ab:c:e:fgi:kl:m:no:p:qstvxACD:F:I:L:NPR:TVXY")) != -1) { + "1246ab:c:e:fgi:kl:m:no:p:qstvxACD:F:I:L:MNPR:S:TVXY")) != -1) { switch (opt) { case '1': options.protocol = SSH_PROTO_1; @@ -338,7 +346,7 @@ again: if (ciphers_valid(optarg)) { /* SSH2 only */ options.ciphers = xstrdup(optarg); - options.cipher = SSH_CIPHER_ILLEGAL; + options.cipher = SSH_CIPHER_INVALID; } else { /* SSH1 only */ options.cipher = cipher_number(optarg); @@ -365,6 +373,10 @@ again: exit(1); } break; + case 'M': + options.control_master = + (options.control_master >= 1) ? 2 : 1; + break; case 'p': options.port = a2port(optarg); if (options.port == 0) { @@ -433,6 +445,11 @@ again: case 's': subsystem_flag = 1; break; + case 'S': + if (options.control_path != NULL) + free(options.control_path); + options.control_path = xstrdup(optarg); + break; case 'b': options.bind_address = optarg; break; @@ -527,16 +544,17 @@ again: * file if the user specifies a config file on the command line. */ if (config != NULL) { - if (!read_config_file(config, host, &options)) + if (!read_config_file(config, host, &options, 0)) fatal("Can't open user config file %.100s: " "%.100s", config, strerror(errno)); } else { snprintf(buf, sizeof buf, "%.100s/%.100s", pw->pw_dir, _PATH_SSH_USER_CONFFILE); - (void)read_config_file(buf, host, &options); + (void)read_config_file(buf, host, &options, 1); /* Read systemwide configuration file after use config. */ - (void)read_config_file(_PATH_HOST_CONFIG_FILE, host, &options); + (void)read_config_file(_PATH_HOST_CONFIG_FILE, host, + &options, 0); } /* Fill configuration defaults. */ @@ -583,6 +601,13 @@ again: strcmp(options.proxy_command, "none") == 0) options.proxy_command = NULL; + if (options.control_path != NULL) { + options.control_path = tilde_expand_filename( + options.control_path, original_real_uid); + } + if (options.control_path != NULL && options.control_master == 0) + control_client(options.control_path); /* This doesn't return */ + /* Open a connection to the remote host. */ if (ssh_connect(host, &hostaddr, options.port, options.address_family, options.connection_attempts, @@ -638,8 +663,10 @@ again: * user's home directory if it happens to be on a NFS volume where * root is mapped to nobody. */ - seteuid(original_real_uid); - setuid(original_real_uid); + if (original_effective_uid == 0) { + PRIV_START; + permanently_set_uid(pw); + } /* * Now that we are back to our own permissions, create ~/.ssh @@ -695,6 +722,9 @@ again: exit_status = compat20 ? ssh_session2() : ssh_session(); packet_close(); + if (options.control_path != NULL && control_fd != -1) + unlink(options.control_path); + /* * Send SIGHUP to proxy command if used. We don't wait() in * case it hangs and instead rely on init to reap the child @@ -794,17 +824,17 @@ x11_get_proto(char **_proto, char **_data) * for the local connection. */ if (!got_data) { - u_int32_t rand = 0; + u_int32_t rnd = 0; logit("Warning: No xauth data; " "using fake authentication data for X11 forwarding."); strlcpy(proto, SSH_X11_PROTO, sizeof proto); for (i = 0; i < 16; i++) { if (i % 4 == 0) - rand = arc4random(); + rnd = arc4random(); snprintf(data + 2 * i, sizeof data - 2 * i, "%02x", - rand & 0xff); - rand >>= 8; + rnd & 0xff); + rnd >>= 8; } } } @@ -991,7 +1021,7 @@ ssh_session(void) } static void -client_subsystem_reply(int type, u_int32_t seq, void *ctxt) +ssh_subsystem_reply(int type, u_int32_t seq, void *ctxt) { int id, len; @@ -1023,40 +1053,53 @@ client_global_request_reply_fwd(int type, u_int32_t seq, void *ctxt) options.remote_forwards[i].port); } -/* request pty/x11/agent/tcpfwd/shell for channel */ static void -ssh_session2_setup(int id, void *arg) +ssh_control_listener(void) { - int len; - int interactive = 0; - struct termios tio; + struct sockaddr_un addr; + mode_t old_umask; + int addr_len; - debug2("ssh_session2_setup: id %d", id); + if (options.control_path == NULL || options.control_master <= 0) + return; - if (tty_flag) { - struct winsize ws; - char *cp; - cp = getenv("TERM"); - if (!cp) - cp = ""; - /* Store window size in the packet. */ - if (ioctl(fileno(stdin), TIOCGWINSZ, &ws) < 0) - memset(&ws, 0, sizeof(ws)); + memset(&addr, '\0', sizeof(addr)); + addr.sun_family = AF_UNIX; + addr_len = offsetof(struct sockaddr_un, sun_path) + + strlen(options.control_path) + 1; - channel_request_start(id, "pty-req", 0); - packet_put_cstring(cp); - packet_put_int(ws.ws_col); - packet_put_int(ws.ws_row); - packet_put_int(ws.ws_xpixel); - packet_put_int(ws.ws_ypixel); - tio = get_saved_tio(); - tty_make_modes(/*ignored*/ 0, &tio); - packet_send(); - interactive = 1; - /* XXX wait for reply */ + if (strlcpy(addr.sun_path, options.control_path, + sizeof(addr.sun_path)) >= sizeof(addr.sun_path)) + fatal("ControlPath too long"); + + if ((control_fd = socket(PF_UNIX, SOCK_STREAM, 0)) < 0) + fatal("%s socket(): %s\n", __func__, strerror(errno)); + + old_umask = umask(0177); + if (bind(control_fd, (struct sockaddr*)&addr, addr_len) == -1) { + control_fd = -1; + if (errno == EINVAL) + fatal("ControlSocket %s already exists", + options.control_path); + else + fatal("%s bind(): %s\n", __func__, strerror(errno)); } - if (options.forward_x11 && - getenv("DISPLAY") != NULL) { + umask(old_umask); + + if (listen(control_fd, 64) == -1) + fatal("%s listen(): %s\n", __func__, strerror(errno)); + + set_nonblock(control_fd); +} + +/* request pty/x11/agent/tcpfwd/shell for channel */ +static void +ssh_session2_setup(int id, void *arg) +{ + extern char **environ; + + int interactive = tty_flag; + if (options.forward_x11 && getenv("DISPLAY") != NULL) { char *proto, *data; /* Get reasonable local authentication information. */ x11_get_proto(&proto, &data); @@ -1074,27 +1117,8 @@ ssh_session2_setup(int id, void *arg) packet_send(); } - len = buffer_len(&command); - if (len > 0) { - if (len > 900) - len = 900; - if (subsystem_flag) { - debug("Sending subsystem: %.*s", len, (u_char *)buffer_ptr(&command)); - channel_request_start(id, "subsystem", /*want reply*/ 1); - /* register callback for reply */ - /* XXX we assume that client_loop has already been called */ - dispatch_set(SSH2_MSG_CHANNEL_FAILURE, &client_subsystem_reply); - dispatch_set(SSH2_MSG_CHANNEL_SUCCESS, &client_subsystem_reply); - } else { - debug("Sending command: %.*s", len, (u_char *)buffer_ptr(&command)); - channel_request_start(id, "exec", 0); - } - packet_put_string(buffer_ptr(&command), buffer_len(&command)); - packet_send(); - } else { - channel_request_start(id, "shell", 0); - packet_send(); - } + client_session2_setup(id, tty_flag, subsystem_flag, getenv("TERM"), + NULL, fileno(stdin), &command, environ, &ssh_subsystem_reply); packet_set_interactive(interactive); } @@ -1140,7 +1164,7 @@ ssh_session2_open(void) channel_send_open(c->self); if (!no_shell_flag) - channel_register_confirm(c->self, ssh_session2_setup); + channel_register_confirm(c->self, ssh_session2_setup, NULL); return c->self; } @@ -1152,6 +1176,7 @@ ssh_session2(void) /* XXX should be pre-session */ ssh_init_forwarding(); + ssh_control_listener(); if (!no_shell_flag || (datafellows & SSH_BUG_DUMMYCHAN)) id = ssh_session2_open(); @@ -1205,3 +1230,149 @@ load_public_identity_files(void) options.identity_keys[i] = public; } } + +static void +control_client_sighandler(int signo) +{ + control_client_terminate = signo; +} + +static void +control_client_sigrelay(int signo) +{ + if (control_server_pid > 1) + kill(control_server_pid, signo); +} + +static int +env_permitted(char *env) +{ + int i; + char name[1024], *cp; + + strlcpy(name, env, sizeof(name)); + if ((cp = strchr(name, '=')) == NULL) + return (0); + + *cp = '\0'; + + for (i = 0; i < options.num_send_env; i++) + if (match_pattern(name, options.send_env[i])) + return (1); + + return (0); +} + +static void +control_client(const char *path) +{ + struct sockaddr_un addr; + int i, r, sock, exitval, num_env, addr_len; + Buffer m; + char *cp; + extern char **environ; + + memset(&addr, '\0', sizeof(addr)); + addr.sun_family = AF_UNIX; + addr_len = offsetof(struct sockaddr_un, sun_path) + + strlen(path) + 1; + + if (strlcpy(addr.sun_path, path, + sizeof(addr.sun_path)) >= sizeof(addr.sun_path)) + fatal("ControlPath too long"); + + if ((sock = socket(PF_UNIX, SOCK_STREAM, 0)) < 0) + fatal("%s socket(): %s", __func__, strerror(errno)); + + if (connect(sock, (struct sockaddr*)&addr, addr_len) == -1) + fatal("Couldn't connect to %s: %s", path, strerror(errno)); + + if ((cp = getenv("TERM")) == NULL) + cp = ""; + + buffer_init(&m); + + /* Get PID of controlee */ + if (ssh_msg_recv(sock, &m) == -1) + fatal("%s: msg_recv", __func__); + if (buffer_get_char(&m) != 0) + fatal("%s: wrong version", __func__); + /* Connection allowed? */ + if (buffer_get_int(&m) != 1) + fatal("Connection to master denied"); + control_server_pid = buffer_get_int(&m); + + buffer_clear(&m); + buffer_put_int(&m, tty_flag); + buffer_put_int(&m, subsystem_flag); + buffer_put_cstring(&m, cp); + + buffer_append(&command, "\0", 1); + buffer_put_cstring(&m, buffer_ptr(&command)); + + if (options.num_send_env == 0 || environ == NULL) { + buffer_put_int(&m, 0); + } else { + /* Pass environment */ + num_env = 0; + for (i = 0; environ[i] != NULL; i++) + if (env_permitted(environ[i])) + num_env++; /* Count */ + + buffer_put_int(&m, num_env); + + for (i = 0; environ[i] != NULL && num_env >= 0; i++) + if (env_permitted(environ[i])) { + num_env--; + buffer_put_cstring(&m, environ[i]); + } + } + + if (ssh_msg_send(sock, /* version */0, &m) == -1) + fatal("%s: msg_send", __func__); + + mm_send_fd(sock, STDIN_FILENO); + mm_send_fd(sock, STDOUT_FILENO); + mm_send_fd(sock, STDERR_FILENO); + + /* Wait for reply, so master has a chance to gather ttymodes */ + buffer_clear(&m); + if (ssh_msg_recv(sock, &m) == -1) + fatal("%s: msg_recv", __func__); + if (buffer_get_char(&m) != 0) + fatal("%s: master returned error", __func__); + buffer_free(&m); + + signal(SIGINT, control_client_sighandler); + signal(SIGTERM, control_client_sighandler); + signal(SIGWINCH, control_client_sigrelay); + + if (tty_flag) + enter_raw_mode(); + + /* Stick around until the controlee closes the client_fd */ + exitval = 0; + for (;!control_client_terminate;) { + r = read(sock, &exitval, sizeof(exitval)); + if (r == 0) { + debug2("Received EOF from master"); + break; + } + if (r > 0) + debug2("Received exit status from master %d", exitval); + if (r == -1 && errno != EINTR) + fatal("%s: read %s", __func__, strerror(errno)); + } + + if (control_client_terminate) + debug2("Exiting on signal %d", control_client_terminate); + + close(sock); + + leave_raw_mode(); + + if (tty_flag && options.log_level != SYSLOG_LEVEL_QUIET) + fprintf(stderr, "Connection to master closed.\r\n"); + + exit(exitval); +} diff --git a/crypto/openssh/ssh_config b/crypto/openssh/ssh_config index 31daf59..0b11c8a 100644 --- a/crypto/openssh/ssh_config +++ b/crypto/openssh/ssh_config @@ -36,4 +36,4 @@ # Cipher 3des # Ciphers aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc # EscapeChar ~ -# VersionAddendum FreeBSD-20040419 +# VersionAddendum FreeBSD-20041028 diff --git a/crypto/openssh/ssh_config.5 b/crypto/openssh/ssh_config.5 index ee8baea..e1cc151 100644 --- a/crypto/openssh/ssh_config.5 +++ b/crypto/openssh/ssh_config.5 @@ -34,8 +34,8 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" +.\" $OpenBSD: ssh_config.5,v 1.38 2004/06/26 09:11:14 jmc Exp $ .\" $FreeBSD$ -.\" $OpenBSD: ssh_config.5,v 1.28 2003/12/16 15:49:51 markus Exp $ .Dd September 25, 1999 .Dt SSH_CONFIG 5 .Os @@ -186,6 +186,18 @@ The default is Specifies the ciphers allowed for protocol version 2 in order of preference. Multiple ciphers must be comma-separated. +The supported ciphers are +.Dq 3des-cbc , +.Dq aes128-cbc , +.Dq aes192-cbc , +.Dq aes256-cbc , +.Dq aes128-ctr , +.Dq aes192-ctr , +.Dq aes256-ctr , +.Dq arcfour , +.Dq blowfish-cbc , +and +.Dq cast128-cbc . The default is .Bd -literal ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour, @@ -233,6 +245,37 @@ Specifies the timeout (in seconds) used when connecting to the ssh server, instead of using the default system TCP timeout. This value is used only when the target is down or really unreachable, not when it refuses the connection. +.It Cm ControlMaster +Enables the sharing of multiple sessions over a single network connection. +When set to +.Dq yes +.Nm ssh +will listen for connections on a control socket specified using the +.Cm ControlPath +argument. +Additional sessions can connect to this socket using the same +.Cm ControlPath +with +.Cm ControlMaster +set to +.Dq no +(the default). +These sessions will reuse the master instance's network connection rather +than initiating new ones. +Setting this to +.Dq ask +will cause +.Nm ssh +to listen for control connections, but require confirmation using the +.Ev SSH_ASKPASS +program before they are accepted (see +.Xr ssh-add 1 +for details). +.It Cm ControlPath +Specify the path to the control socket used for connection sharing. +See +.Cm ControlMaster +above. .It Cm DynamicForward Specifies that a TCP/IP port on the local machine be forwarded over the secure channel, and the application @@ -314,7 +357,7 @@ if the .Cm ForwardX11Trusted option is also enabled. .It Cm ForwardX11Trusted -If the this option is set to +If this option is set to .Dq yes then remote X11 clients will have full access to the original X11 display. If this option is set to @@ -411,7 +454,7 @@ identities will be tried in sequence. Specifies that .Nm ssh should only use the authentication identity files configured in the -.Nm +.Nm files, even if the .Nm ssh-agent @@ -571,6 +614,27 @@ running. The default is .Dq yes . Note that this option applies to protocol version 1 only. +.It Cm SendEnv +Specifies what variables from the local +.Xr environ 7 +should be sent to the server. +Note that environment passing is only supported for protocol 2, the +server must also support it, and the server must be configured to +accept these environment variables. +Refer to +.Cm AcceptEnv +in +.Xr sshd_config 5 +for how to configure the server. +Variables are specified by name, which may contain the wildcard characters +.Ql \&* +and +.Ql \&? . +Multiple environment variables may be separated by whitespace or spread +across multiple +.Cm SendEnv +directives. +The default is not to send any environment variables. .It Cm ServerAliveInterval Sets a timeout interval in seconds after which if no data has been received from the server, @@ -719,7 +783,7 @@ Note that this option applies to protocol version 2 only. Specifies a string to append to the regular version string to identify OS- or site-specific modifications. The default is -.Dq FreeBSD-20040419 . +.Dq FreeBSD-20041028 . .It Cm XAuthLocation Specifies the full pathname of the .Xr xauth 1 @@ -735,9 +799,8 @@ The format of this file is described above. This file is used by the .Nm ssh client. -This file does not usually contain any sensitive information, -but the recommended permissions are read/write for the user, and not -accessible by others. +Because of the potential for abuse, this file must have strict permissions: +read/write for the user, and not accessible by others. .It Pa /etc/ssh/ssh_config Systemwide configuration file. This file provides defaults for those diff --git a/crypto/openssh/sshconnect.c b/crypto/openssh/sshconnect.c index dfeddd3..11008e5 100644 --- a/crypto/openssh/sshconnect.c +++ b/crypto/openssh/sshconnect.c @@ -13,7 +13,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: sshconnect.c,v 1.156 2004/01/25 03:49:09 djm Exp $"); +RCSID("$OpenBSD: sshconnect.c,v 1.158 2004/06/21 17:36:31 avsm Exp $"); #include <openssl/bn.h> @@ -31,7 +31,6 @@ RCSID("$OpenBSD: sshconnect.c,v 1.156 2004/01/25 03:49:09 djm Exp $"); #include "readconf.h" #include "atomicio.h" #include "misc.h" -#include "readpass.h" #include "dns.h" @@ -768,19 +767,19 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key, break; case HOST_CHANGED: if (options.check_host_ip && host_ip_differ) { - char *msg; + char *key_msg; if (ip_status == HOST_NEW) - msg = "is unknown"; + key_msg = "is unknown"; else if (ip_status == HOST_OK) - msg = "is unchanged"; + key_msg = "is unchanged"; else - msg = "has a different value"; + key_msg = "has a different value"; error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@"); error("@ WARNING: POSSIBLE DNS SPOOFING DETECTED! @"); error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@"); error("The %s host key for %s has changed,", type, host); error("and the key for the according IP address %s", ip); - error("%s. This could either mean that", msg); + error("%s. This could either mean that", key_msg); error("DNS SPOOFING is happening or the IP address for the host"); error("and its host key have changed at the same time."); if (ip_status != HOST_NEW) diff --git a/crypto/openssh/sshconnect1.c b/crypto/openssh/sshconnect1.c index 2f89964..6e2e31c 100644 --- a/crypto/openssh/sshconnect1.c +++ b/crypto/openssh/sshconnect1.c @@ -13,7 +13,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: sshconnect1.c,v 1.56 2003/08/28 12:54:34 markus Exp $"); +RCSID("$OpenBSD: sshconnect1.c,v 1.60 2004/07/28 09:40:29 markus Exp $"); #include <openssl/bn.h> #include <openssl/md5.h> @@ -24,7 +24,7 @@ RCSID("$OpenBSD: sshconnect1.c,v 1.56 2003/08/28 12:54:34 markus Exp $"); #include "rsa.h" #include "buffer.h" #include "packet.h" -#include "mpaux.h" +#include "kex.h" #include "uidswap.h" #include "log.h" #include "readconf.h" @@ -32,7 +32,7 @@ RCSID("$OpenBSD: sshconnect1.c,v 1.56 2003/08/28 12:54:34 markus Exp $"); #include "authfd.h" #include "sshconnect.h" #include "authfile.h" -#include "readpass.h" +#include "misc.h" #include "cipher.h" #include "canohost.h" #include "auth.h" @@ -476,7 +476,7 @@ ssh_kex(char *host, struct sockaddr *hostaddr) u_char cookie[8]; u_int supported_ciphers; u_int server_flags, client_flags; - u_int32_t rand = 0; + u_int32_t rnd = 0; debug("Waiting for server public key."); @@ -528,7 +528,7 @@ ssh_kex(char *host, struct sockaddr *hostaddr) client_flags = SSH_PROTOFLAG_SCREEN_NUMBER | SSH_PROTOFLAG_HOST_IN_FWD_OPEN; - compute_session_id(session_id, cookie, host_key->rsa->n, server_key->rsa->n); + derive_ssh1_session_id(host_key->rsa->n, server_key->rsa->n, cookie, session_id); /* Generate a session key. */ arc4random_stir(); @@ -540,9 +540,9 @@ ssh_kex(char *host, struct sockaddr *hostaddr) */ for (i = 0; i < 32; i++) { if (i % 4 == 0) - rand = arc4random(); - session_key[i] = rand & 0xff; - rand >>= 8; + rnd = arc4random(); + session_key[i] = rnd & 0xff; + rnd >>= 8; } /* @@ -598,7 +598,7 @@ ssh_kex(char *host, struct sockaddr *hostaddr) if (options.cipher == SSH_CIPHER_NOT_SET) { if (cipher_mask_ssh1(1) & supported_ciphers & (1 << ssh_cipher_default)) options.cipher = ssh_cipher_default; - } else if (options.cipher == SSH_CIPHER_ILLEGAL || + } else if (options.cipher == SSH_CIPHER_INVALID || !(cipher_mask_ssh1(1) & (1 << options.cipher))) { logit("No valid SSH1 cipher, using %.100s instead.", cipher_name(ssh_cipher_default)); diff --git a/crypto/openssh/sshconnect2.c b/crypto/openssh/sshconnect2.c index c261dfd..68d56d0 100644 --- a/crypto/openssh/sshconnect2.c +++ b/crypto/openssh/sshconnect2.c @@ -23,7 +23,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: sshconnect2.c,v 1.135 2004/03/05 10:53:58 markus Exp $"); +RCSID("$OpenBSD: sshconnect2.c,v 1.138 2004/06/13 12:53:24 djm Exp $"); #include "openbsd-compat/sys-queue.h" @@ -43,7 +43,7 @@ RCSID("$OpenBSD: sshconnect2.c,v 1.135 2004/03/05 10:53:58 markus Exp $"); #include "authfd.h" #include "log.h" #include "readconf.h" -#include "readpass.h" +#include "misc.h" #include "match.h" #include "dispatch.h" #include "canohost.h" @@ -120,6 +120,7 @@ ssh_kex2(char *host, struct sockaddr *hostaddr) /* start key exchange */ kex = kex_setup(myproposal); kex->kex[KEX_DH_GRP1_SHA1] = kexdh_client; + kex->kex[KEX_DH_GRP14_SHA1] = kexdh_client; kex->kex[KEX_DH_GEX_SHA1] = kexgex_client; kex->client_version_string=client_version_string; kex->server_version_string=server_version_string; @@ -458,7 +459,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, void *ctxt) * moved to the end of the queue. this also avoids confusion by * duplicate keys */ - TAILQ_FOREACH_REVERSE(id, &authctxt->keys, next, idlist) { + TAILQ_FOREACH_REVERSE(id, &authctxt->keys, idlist, next) { if (key_equal(key, id->key)) { sent = sign_and_send_pubkey(authctxt, id); break; diff --git a/crypto/openssh/sshd.8 b/crypto/openssh/sshd.8 index 2ed44cc..0402a64 100644 --- a/crypto/openssh/sshd.8 +++ b/crypto/openssh/sshd.8 @@ -34,7 +34,7 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.\" $OpenBSD: sshd.8,v 1.200 2003/10/08 08:27:36 jmc Exp $ +.\" $OpenBSD: sshd.8,v 1.201 2004/05/02 11:54:31 dtucker Exp $ .\" $FreeBSD$ .Dd September 25, 1999 .Dt SSHD 8 @@ -197,7 +197,7 @@ configuration file. .Nm rereads its configuration file when it receives a hangup signal, .Dv SIGHUP , -by executing itself with the name it was started as, i.e., +by executing itself with the name and options it was started with, e.g., .Pa /usr/sbin/sshd . .Pp The options are as follows: diff --git a/crypto/openssh/sshd.c b/crypto/openssh/sshd.c index 22c2e3d..0e5dbf2 100644 --- a/crypto/openssh/sshd.c +++ b/crypto/openssh/sshd.c @@ -42,8 +42,8 @@ */ #include "includes.h" +RCSID("$OpenBSD: sshd.c,v 1.301 2004/08/11 11:50:09 dtucker Exp $"); RCSID("$FreeBSD$"); -RCSID("$OpenBSD: sshd.c,v 1.286 2004/02/23 12:02:33 markus Exp $"); #include <openssl/dh.h> #include <openssl/bn.h> @@ -65,12 +65,12 @@ RCSID("$OpenBSD: sshd.c,v 1.286 2004/02/23 12:02:33 markus Exp $"); #include "rsa.h" #include "sshpty.h" #include "packet.h" -#include "mpaux.h" #include "log.h" #include "servconf.h" #include "uidswap.h" #include "compat.h" #include "buffer.h" +#include "bufaux.h" #include "cipher.h" #include "kex.h" #include "key.h" @@ -82,6 +82,7 @@ RCSID("$OpenBSD: sshd.c,v 1.286 2004/02/23 12:02:33 markus Exp $"); #include "canohost.h" #include "auth.h" #include "misc.h" +#include "msg.h" #include "dispatch.h" #include "channels.h" #include "session.h" @@ -101,11 +102,13 @@ int deny_severity = LOG_WARNING; #define O_NOCTTY 0 #endif -#ifdef HAVE___PROGNAME +/* Re-exec fds */ +#define REEXEC_DEVCRYPTO_RESERVED_FD (STDERR_FILENO + 1) +#define REEXEC_STARTUP_PIPE_FD (STDERR_FILENO + 2) +#define REEXEC_CONFIG_PASS_FD (STDERR_FILENO + 3) +#define REEXEC_MIN_FREE_FD (STDERR_FILENO + 4) + extern char *__progname; -#else -char *__progname; -#endif /* Server configuration options. */ ServerOptions options; @@ -143,6 +146,12 @@ int log_stderr = 0; char **saved_argv; int saved_argc; +/* re-exec */ +int rexeced_flag = 0; +int rexec_flag = 1; +int rexec_argc = 0; +char **rexec_argv; + /* * The sockets that the server is listening; this is used in the SIGHUP * signal handler. @@ -206,12 +215,12 @@ int startup_pipe; /* in child */ int use_privsep; struct monitor *pmonitor = NULL; -/* message to be displayed after login */ -Buffer loginmsg; - /* global authentication context */ Authctxt *the_authctxt = NULL; +/* message to be displayed after login */ +Buffer loginmsg; + /* Prototypes for various functions defined later in this file. */ void destroy_sensitive_data(void); void demote_sensitive_data(void); @@ -655,6 +664,7 @@ privsep_postauth(Authctxt *authctxt) else if (pmonitor->m_pid != 0) { debug2("User child is on pid %ld", (long)pmonitor->m_pid); close(pmonitor->m_recvfd); + buffer_clear(&loginmsg); monitor_child_postauth(pmonitor); /* NEVERREACHED */ @@ -777,6 +787,87 @@ usage(void) exit(1); } +static void +send_rexec_state(int fd, Buffer *conf) +{ + Buffer m; + + debug3("%s: entering fd = %d config len %d", __func__, fd, + buffer_len(conf)); + + /* + * Protocol from reexec master to child: + * string configuration + * u_int ephemeral_key_follows + * bignum e (only if ephemeral_key_follows == 1) + * bignum n " + * bignum d " + * bignum iqmp " + * bignum p " + * bignum q " + */ + buffer_init(&m); + buffer_put_cstring(&m, buffer_ptr(conf)); + + if (sensitive_data.server_key != NULL && + sensitive_data.server_key->type == KEY_RSA1) { + buffer_put_int(&m, 1); + buffer_put_bignum(&m, sensitive_data.server_key->rsa->e); + buffer_put_bignum(&m, sensitive_data.server_key->rsa->n); + buffer_put_bignum(&m, sensitive_data.server_key->rsa->d); + buffer_put_bignum(&m, sensitive_data.server_key->rsa->iqmp); + buffer_put_bignum(&m, sensitive_data.server_key->rsa->p); + buffer_put_bignum(&m, sensitive_data.server_key->rsa->q); + } else + buffer_put_int(&m, 0); + + if (ssh_msg_send(fd, 0, &m) == -1) + fatal("%s: ssh_msg_send failed", __func__); + + buffer_free(&m); + + debug3("%s: done", __func__); +} + +static void +recv_rexec_state(int fd, Buffer *conf) +{ + Buffer m; + char *cp; + u_int len; + + debug3("%s: entering fd = %d", __func__, fd); + + buffer_init(&m); + + if (ssh_msg_recv(fd, &m) == -1) + fatal("%s: ssh_msg_recv failed", __func__); + if (buffer_get_char(&m) != 0) + fatal("%s: rexec version mismatch", __func__); + + cp = buffer_get_string(&m, &len); + if (conf != NULL) + buffer_append(conf, cp, len + 1); + xfree(cp); + + if (buffer_get_int(&m)) { + if (sensitive_data.server_key != NULL) + key_free(sensitive_data.server_key); + sensitive_data.server_key = key_new_private(KEY_RSA1); + buffer_get_bignum(&m, sensitive_data.server_key->rsa->e); + buffer_get_bignum(&m, sensitive_data.server_key->rsa->n); + buffer_get_bignum(&m, sensitive_data.server_key->rsa->d); + buffer_get_bignum(&m, sensitive_data.server_key->rsa->iqmp); + buffer_get_bignum(&m, sensitive_data.server_key->rsa->p); + buffer_get_bignum(&m, sensitive_data.server_key->rsa->q); + rsa_generate_additional_parameters( + sensitive_data.server_key->rsa); + } + buffer_free(&m); + + debug3("%s: done", __func__); +} + /* * Main program for the daemon. */ @@ -785,7 +876,8 @@ main(int ac, char **av) { extern char *optarg; extern int optind; - int opt, sock_in = 0, sock_out = 0, newsock, j, i, fdsetsz, on = 1; + int opt, j, i, fdsetsz, on = 1; + int sock_in = -1, sock_out = -1, newsock = -1; pid_t pid; socklen_t fromlen; fd_set *fdset; @@ -797,11 +889,12 @@ main(int ac, char **av) char ntop[NI_MAXHOST], strport[NI_MAXSERV]; char *line; int listen_sock, maxfd; - int startup_p[2]; + int startup_p[2], config_s[2]; int startups = 0; Key *key; Authctxt *authctxt; int ret, key_used = 0; + Buffer cfg; #ifdef HAVE_SECUREWARE (void)set_auth_parameters(ac, av); @@ -811,6 +904,7 @@ main(int ac, char **av) /* Save argv. Duplicate so setproctitle emulation doesn't clobber it */ saved_argc = ac; + rexec_argc = ac; saved_argv = xmalloc(sizeof(*saved_argv) * (ac + 1)); for (i = 0; i < ac; i++) saved_argv[i] = xstrdup(av[i]); @@ -829,7 +923,7 @@ main(int ac, char **av) initialize_server_options(&options); /* Parse command-line arguments. */ - while ((opt = getopt(ac, av, "f:p:b:k:h:g:u:o:dDeiqtQ46")) != -1) { + while ((opt = getopt(ac, av, "f:p:b:k:h:g:u:o:dDeiqrtQR46")) != -1) { switch (opt) { case '4': IPv4or6 = AF_INET; @@ -856,6 +950,13 @@ main(int ac, char **av) case 'i': inetd_flag = 1; break; + case 'r': + rexec_flag = 0; + break; + case 'R': + rexeced_flag = 1; + inetd_flag = 1; + break; case 'Q': /* ignored */ break; @@ -919,6 +1020,15 @@ main(int ac, char **av) break; } } + if (rexeced_flag || inetd_flag) + rexec_flag = 0; + if (rexec_flag && (av[0] == NULL || *av[0] != '/')) + fatal("sshd re-exec requires execution with an absolute path"); + if (rexeced_flag) + closefrom(REEXEC_MIN_FREE_FD); + else + closefrom(REEXEC_DEVCRYPTO_RESERVED_FD); + SSLeay_add_all_algorithms(); channel_set_af(IPv4or6); @@ -941,7 +1051,7 @@ main(int ac, char **av) unsetenv("KRB5CCNAME"); #endif /* _AIX */ #ifdef _UNICOS - /* Cray can define user privs drop all prives now! + /* Cray can define user privs drop all privs now! * Not needed on PRIV_SU systems! */ drop_cray_privs(); @@ -949,8 +1059,23 @@ main(int ac, char **av) seed_rng(); - /* Read server configuration options from the configuration file. */ - read_server_config(&options, config_file_name); + sensitive_data.server_key = NULL; + sensitive_data.ssh1_host_key = NULL; + sensitive_data.have_ssh1_key = 0; + sensitive_data.have_ssh2_key = 0; + + /* Fetch our configuration */ + buffer_init(&cfg); + if (rexeced_flag) + recv_rexec_state(REEXEC_CONFIG_PASS_FD, &cfg); + else + load_server_config(config_file_name, &cfg); + + parse_server_config(&options, + rexeced_flag ? "rexec" : config_file_name, &cfg); + + if (!rexec_flag) + buffer_free(&cfg); /* Fill in default values for those options not explicitly set. */ fill_default_server_options(&options); @@ -968,10 +1093,6 @@ main(int ac, char **av) sizeof(Key *)); for (i = 0; i < options.num_host_key_files; i++) sensitive_data.host_keys[i] = NULL; - sensitive_data.server_key = NULL; - sensitive_data.ssh1_host_key = NULL; - sensitive_data.have_ssh1_key = 0; - sensitive_data.have_ssh2_key = 0; for (i = 0; i < options.num_host_key_files; i++) { key = key_load_private(options.host_key_files[i], "", NULL); @@ -1070,6 +1191,16 @@ main(int ac, char **av) if (setgroups(0, NULL) < 0) debug("setgroups() failed: %.200s", strerror(errno)); + if (rexec_flag) { + rexec_argv = xmalloc(sizeof(char *) * (rexec_argc + 2)); + for (i = 0; i < rexec_argc; i++) { + debug("rexec_argv[%d]='%s'", i, saved_argv[i]); + rexec_argv[i] = saved_argv[i]; + } + rexec_argv[rexec_argc] = "-R"; + rexec_argv[rexec_argc + 1] = NULL; + } + /* Initialize the log (it is reinitialized below in case we forked). */ if (debug_flag && !inetd_flag) log_stderr = 1; @@ -1111,19 +1242,34 @@ main(int ac, char **av) /* Start listening for a socket, unless started from inetd. */ if (inetd_flag) { - int s1; - s1 = dup(0); /* Make sure descriptors 0, 1, and 2 are in use. */ - dup(s1); - sock_in = dup(0); - sock_out = dup(1); + int fd; + startup_pipe = -1; + if (rexeced_flag) { + close(REEXEC_CONFIG_PASS_FD); + sock_in = sock_out = dup(STDIN_FILENO); + if (!debug_flag) { + startup_pipe = dup(REEXEC_STARTUP_PIPE_FD); + close(REEXEC_STARTUP_PIPE_FD); + } + } else { + sock_in = dup(STDIN_FILENO); + sock_out = dup(STDOUT_FILENO); + } /* * We intentionally do not close the descriptors 0, 1, and 2 - * as our code for setting the descriptors won\'t work if + * as our code for setting the descriptors won't work if * ttyfd happens to be one of those. */ + if ((fd = open(_PATH_DEVNULL, O_RDWR, 0)) != -1) { + dup2(fd, STDIN_FILENO); + dup2(fd, STDOUT_FILENO); + if (fd > STDOUT_FILENO) + close(fd); + } debug("inetd sockets after dupping: %d, %d", sock_in, sock_out); - if (options.protocol & SSH_PROTO_1) + if ((options.protocol & SSH_PROTO_1) && + sensitive_data.server_key == NULL) generate_ephemeral_server_key(); } else { for (ai = options.listen_addrs; ai; ai = ai->ai_next) { @@ -1146,8 +1292,7 @@ main(int ac, char **av) verbose("socket: %.100s", strerror(errno)); continue; } - if (fcntl(listen_sock, F_SETFL, O_NONBLOCK) < 0) { - error("listen_sock O_NONBLOCK: %s", strerror(errno)); + if (set_nonblock(listen_sock) == -1) { close(listen_sock); continue; } @@ -1290,8 +1435,7 @@ main(int ac, char **av) error("accept: %.100s", strerror(errno)); continue; } - if (fcntl(newsock, F_SETFL, 0) < 0) { - error("newsock del O_NONBLOCK: %s", strerror(errno)); + if (unset_nonblock(newsock) == -1) { close(newsock); continue; } @@ -1305,6 +1449,16 @@ main(int ac, char **av) continue; } + if (rexec_flag && socketpair(AF_UNIX, + SOCK_STREAM, 0, config_s) == -1) { + error("reexec socketpair: %s", + strerror(errno)); + close(newsock); + close(startup_p[0]); + close(startup_p[1]); + continue; + } + for (j = 0; j < options.max_startups; j++) if (startup_pipes[j] == -1) { startup_pipes[j] = startup_p[0]; @@ -1328,8 +1482,15 @@ main(int ac, char **av) close_listen_socks(); sock_in = newsock; sock_out = newsock; + close(startup_p[0]); + close(startup_p[1]); startup_pipe = -1; pid = getpid(); + if (rexec_flag) { + send_rexec_state(config_s[0], + &cfg); + close(config_s[0]); + } break; } else { /* @@ -1351,6 +1512,7 @@ main(int ac, char **av) sock_in = newsock; sock_out = newsock; log_init(__progname, options.log_level, options.log_facility, log_stderr); + close(config_s[0]); break; } } @@ -1363,6 +1525,12 @@ main(int ac, char **av) close(startup_p[1]); + if (rexec_flag) { + send_rexec_state(config_s[0], &cfg); + close(config_s[0]); + close(config_s[1]); + } + /* Mark that the key has been used (it was "given" to the child). */ if ((options.protocol & SSH_PROTO_1) && key_used == 0) { @@ -1401,6 +1569,46 @@ main(int ac, char **av) error("setsid: %.100s", strerror(errno)); #endif + if (rexec_flag) { + int fd; + + debug("rexec start in %d out %d newsock %d pipe %d sock %d", + sock_in, sock_out, newsock, startup_pipe, config_s[0]); + dup2(newsock, STDIN_FILENO); + dup2(STDIN_FILENO, STDOUT_FILENO); + if (startup_pipe == -1) + close(REEXEC_STARTUP_PIPE_FD); + else + dup2(startup_pipe, REEXEC_STARTUP_PIPE_FD); + + dup2(config_s[1], REEXEC_CONFIG_PASS_FD); + close(config_s[1]); + if (startup_pipe != -1) + close(startup_pipe); + + execv(rexec_argv[0], rexec_argv); + + /* Reexec has failed, fall back and continue */ + error("rexec of %s failed: %s", rexec_argv[0], strerror(errno)); + recv_rexec_state(REEXEC_CONFIG_PASS_FD, NULL); + log_init(__progname, options.log_level, + options.log_facility, log_stderr); + + /* Clean up fds */ + startup_pipe = REEXEC_STARTUP_PIPE_FD; + close(config_s[1]); + close(REEXEC_CONFIG_PASS_FD); + newsock = sock_out = sock_in = dup(STDIN_FILENO); + if ((fd = open(_PATH_DEVNULL, O_RDWR, 0)) != -1) { + dup2(fd, STDIN_FILENO); + dup2(fd, STDOUT_FILENO); + if (fd > STDERR_FILENO) + close(fd); + } + debug("rexec cleanup in %d out %d newsock %d pipe %d sock %d", + sock_in, sock_out, newsock, startup_pipe, config_s[0]); + } + /* * Disable the key regeneration alarm. We will not regenerate the * key since we are no longer in a position to give it to anyone. We @@ -1442,7 +1650,7 @@ main(int ac, char **av) #ifdef LIBWRAP /* Check whether logins are denied from this host. */ - { + if (packet_connection_is_on_socket()) { struct request_info req; request_init(&req, RQ_DAEMON, __progname, RQ_FILE, sock_in, 0); @@ -1490,6 +1698,9 @@ main(int ac, char **av) if (privsep_preauth(authctxt) == 1) goto authenticated; + /* prepare buffer to collect messages to display to user after login */ + buffer_init(&loginmsg); + /* perform the key exchange */ /* authenticate user and start session */ if (compat20) { @@ -1705,9 +1916,10 @@ do_ssh1_kex(void) BN_bn2bin(session_key_int, session_key + sizeof(session_key) - len); - compute_session_id(session_id, cookie, + derive_ssh1_session_id( sensitive_data.ssh1_host_key->rsa->n, - sensitive_data.server_key->rsa->n); + sensitive_data.server_key->rsa->n, + cookie, session_id); /* * Xor the first 16 bytes of the session key with the * session id. @@ -1790,6 +2002,7 @@ do_ssh2_kex(void) /* start key exchange */ kex = kex_setup(myproposal); kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server; + kex->kex[KEX_DH_GRP14_SHA1] = kexdh_server; kex->kex[KEX_DH_GEX_SHA1] = kexgex_server; kex->server = 1; kex->client_version_string=client_version_string; diff --git a/crypto/openssh/sshd_config b/crypto/openssh/sshd_config index 2f7c103..980da4b 100644 --- a/crypto/openssh/sshd_config +++ b/crypto/openssh/sshd_config @@ -1,4 +1,4 @@ -# $OpenBSD: sshd_config,v 1.68 2003/12/29 16:39:50 millert Exp $ +# $OpenBSD: sshd_config,v 1.69 2004/05/23 23:59:53 dtucker Exp $ # $FreeBSD$ # This is the sshd server system-wide configuration file. See @@ -14,7 +14,7 @@ # Note that some of FreeBSD's defaults differ from OpenBSD's, and # FreeBSD has a few additional options. -#VersionAddendum FreeBSD-20040419 +#VersionAddendum FreeBSD-20041028 #Port 22 #Protocol 2 @@ -40,6 +40,7 @@ #LoginGraceTime 2m #PermitRootLogin no #StrictModes yes +#MaxAuthTries 6 #RSAAuthentication yes #PubkeyAuthentication yes @@ -72,8 +73,14 @@ #GSSAPIAuthentication no #GSSAPICleanupCredentials yes -# Set this to 'no' to disable PAM authentication (via challenge-response) -# and session processing. +# Set this to 'no' to disable PAM authentication, account processing, +# and session processing. If this is enabled, PAM authentication will +# be allowed through the ChallengeResponseAuthentication mechanism. +# Depending on your PAM configuration, this may bypass the setting of +# PasswordAuthentication, PermitEmptyPasswords, and +# "PermitRootLogin without-password". If you just want the PAM account and +# session checks to run without PAM authentication, then enable this but set +# ChallengeResponseAuthentication=no #UsePAM yes #AllowTcpForwarding yes diff --git a/crypto/openssh/sshd_config.5 b/crypto/openssh/sshd_config.5 index 1e62104..b8bb78e 100644 --- a/crypto/openssh/sshd_config.5 +++ b/crypto/openssh/sshd_config.5 @@ -34,8 +34,8 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" +.\" $OpenBSD: sshd_config.5,v 1.35 2004/06/26 09:14:40 jmc Exp $ .\" $FreeBSD$ -.\" $OpenBSD: sshd_config.5,v 1.28 2004/02/17 19:35:21 jmc Exp $ .Dd September 25, 1999 .Dt SSHD_CONFIG 5 .Os @@ -62,6 +62,28 @@ The possible keywords and their meanings are as follows (note that keywords are case-insensitive and arguments are case-sensitive): .Bl -tag -width Ds +.It Cm AcceptEnv +Specifies what environment variables sent by the client will be copied into +the session's +.Xr environ 7 . +See +.Cm SendEnv +in +.Xr ssh_config 5 +for how to configure the client. +Note that environment passing is only supported for protocol 2. +Variables are specified by name, which may contain the wildcard characters +.Ql \&* +and +.Ql \&? . +Multiple environment variables may be separated by whitespace or spread +across multiple +.Cm AcceptEnv +directives. +Be warned that some environment variables could be used to bypass restricted +user environments. +For this reason, care should be taken in the use of this directive. +The default is not to accept any environment variables. .It Cm AllowGroups This keyword can be followed by a list of group name patterns, separated by spaces. @@ -74,7 +96,6 @@ can be used as wildcards in the patterns. Only group names are valid; a numerical group ID is not recognized. By default, login is allowed for all groups. -.Pp .It Cm AllowTcpForwarding Specifies whether TCP forwarding is permitted. The default is @@ -82,7 +103,6 @@ The default is Note that disabling TCP forwarding does not improve security unless users are also denied shell access, as they can always install their own forwarders. -.Pp .It Cm AllowUsers This keyword can be followed by a list of user name patterns, separated by spaces. @@ -98,7 +118,6 @@ By default, login is allowed for all users. If the pattern takes the form USER@HOST then USER and HOST are separately checked, restricting logins to particular users from particular hosts. -.Pp .It Cm AuthorizedKeysFile Specifies the file that contains the public keys that can be used for user authentication. @@ -121,7 +140,6 @@ The contents of the specified file are sent to the remote user before authentication is allowed. This option is only available for protocol version 2. By default, no banner is displayed. -.Pp .It Cm ChallengeResponseAuthentication Specifies whether challenge-response authentication is allowed. Specifically, in @@ -139,8 +157,19 @@ The default is .It Cm Ciphers Specifies the ciphers allowed for protocol version 2. Multiple ciphers must be comma-separated. +The supported ciphers are +.Dq 3des-cbc , +.Dq aes128-cbc , +.Dq aes192-cbc , +.Dq aes256-cbc , +.Dq aes128-ctr , +.Dq aes192-ctr , +.Dq aes256-ctr , +.Dq arcfour , +.Dq blowfish-cbc , +and +.Dq cast128-cbc . The default is -.Pp .Bd -literal ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour, aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr'' @@ -201,7 +230,6 @@ can be used as wildcards in the patterns. Only group names are valid; a numerical group ID is not recognized. By default, login is allowed for all groups. -.Pp .It Cm DenyUsers This keyword can be followed by a list of user name patterns, separated by spaces. @@ -392,6 +420,12 @@ for data integrity protection. Multiple algorithms must be comma-separated. The default is .Dq hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96 . +.It Cm MaxAuthTries +Specifies the maximum number of authentication attempts permitted per +connection. +Once the number of failures reaches half this value, +additional failures are logged. +The default is 6. .It Cm MaxStartups Specifies the maximum number of concurrent unauthenticated connections to the .Nm sshd @@ -638,12 +672,25 @@ If .Cm UsePrivilegeSeparation is specified, it will be disabled after authentication. .It Cm UsePAM -Enables PAM authentication (via challenge-response) and session set up. -If you enable this, you should probably disable -.Cm PasswordAuthentication . -If you enable -.CM UsePAM -then you will not be able to run sshd as a non-root user. The default is +Enables the Pluggable Authentication Module interface. +If set to +.Dq yes +this will enable PAM authentication using +.Cm ChallengeResponseAuthentication +and PAM account and session module processing for all authentication types. +.Pp +Because PAM challenge-response authentication usually serves an equivalent +role to password authentication, you should disable either +.Cm PasswordAuthentication +or +.Cm ChallengeResponseAuthentication. +.Pp +If +.Cm UsePAM +is enabled, you will not be able to run +.Xr sshd 8 +as a non-root user. +The default is .Dq yes . .It Cm UsePrivilegeSeparation Specifies whether @@ -660,7 +707,7 @@ The default is Specifies a string to append to the regular version string to identify OS- or site-specific modifications. The default is -.Dq FreeBSD-20040419 . +.Dq FreeBSD-20041028 . .It Cm X11DisplayOffset Specifies the first display number available for .Nm sshd Ns 's diff --git a/crypto/openssh/sshlogin.c b/crypto/openssh/sshlogin.c index e1cc4cc..15eb916 100644 --- a/crypto/openssh/sshlogin.c +++ b/crypto/openssh/sshlogin.c @@ -39,9 +39,15 @@ */ #include "includes.h" -RCSID("$OpenBSD: sshlogin.c,v 1.7 2003/06/12 07:57:38 markus Exp $"); +RCSID("$OpenBSD: sshlogin.c,v 1.13 2004/08/12 09:18:24 djm Exp $"); #include "loginrec.h" +#include "log.h" +#include "buffer.h" +#include "servconf.h" + +extern Buffer loginmsg; +extern ServerOptions options; /* * Returns the time when the user last logged in. Returns 0 if the @@ -60,16 +66,51 @@ get_last_login_time(uid_t uid, const char *logname, } /* + * Generate and store last login message. This must be done before + * login_login() is called and lastlog is updated. + */ +static void +store_lastlog_message(const char *user, uid_t uid) +{ + char *time_string, hostname[MAXHOSTNAMELEN] = "", buf[512]; + time_t last_login_time; + +#ifndef NO_SSH_LASTLOG + if (!options.print_lastlog) + return; + + last_login_time = get_last_login_time(uid, user, hostname, + sizeof(hostname)); + + if (last_login_time != 0) { + time_string = ctime(&last_login_time); + if (strchr(time_string, '\n')) + *strchr(time_string, '\n') = '\0'; + if (strcmp(hostname, "") == 0) + snprintf(buf, sizeof(buf), "Last login: %s\r\n", + time_string); + else + snprintf(buf, sizeof(buf), "Last login: %s from %s\r\n", + time_string, hostname); + buffer_append(&loginmsg, buf, strlen(buf)); + } +#endif /* NO_SSH_LASTLOG */ +} + +/* * Records that the user has logged in. I wish these parts of operating * systems were more standardized. */ void -record_login(pid_t pid, const char *ttyname, const char *user, uid_t uid, +record_login(pid_t pid, const char *tty, const char *user, uid_t uid, const char *host, struct sockaddr * addr, socklen_t addrlen) { struct logininfo *li; - li = login_alloc_entry(pid, user, host, ttyname); + /* save previous login details before writing new */ + store_lastlog_message(user, uid); + + li = login_alloc_entry(pid, user, host, tty); login_set_addr(li, addr, addrlen); login_login(li); login_free_entry(li); @@ -91,11 +132,11 @@ record_utmp_only(pid_t pid, const char *ttyname, const char *user, /* Records that the user has logged out. */ void -record_logout(pid_t pid, const char *ttyname, const char *user) +record_logout(pid_t pid, const char *tty, const char *user) { struct logininfo *li; - li = login_alloc_entry(pid, user, NULL, ttyname); + li = login_alloc_entry(pid, user, NULL, tty); login_logout(li); login_free_entry(li); } diff --git a/crypto/openssh/sshpty.c b/crypto/openssh/sshpty.c index 0fe3891..efd1dfe 100644 --- a/crypto/openssh/sshpty.c +++ b/crypto/openssh/sshpty.c @@ -12,7 +12,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: sshpty.c,v 1.11 2004/01/11 21:55:06 deraadt Exp $"); +RCSID("$OpenBSD: sshpty.c,v 1.12 2004/06/21 17:36:31 avsm Exp $"); #ifdef HAVE_UTIL_H # include <util.h> @@ -60,18 +60,18 @@ pty_allocate(int *ptyfd, int *ttyfd, char *namebuf, int namebuflen) /* Releases the tty. Its ownership is returned to root, and permissions to 0666. */ void -pty_release(const char *ttyname) +pty_release(const char *tty) { - if (chown(ttyname, (uid_t) 0, (gid_t) 0) < 0) - error("chown %.100s 0 0 failed: %.100s", ttyname, strerror(errno)); - if (chmod(ttyname, (mode_t) 0666) < 0) - error("chmod %.100s 0666 failed: %.100s", ttyname, strerror(errno)); + if (chown(tty, (uid_t) 0, (gid_t) 0) < 0) + error("chown %.100s 0 0 failed: %.100s", tty, strerror(errno)); + if (chmod(tty, (mode_t) 0666) < 0) + error("chmod %.100s 0666 failed: %.100s", tty, strerror(errno)); } /* Makes the tty the process's controlling tty and sets it to sane modes. */ void -pty_make_controlling_tty(int *ttyfd, const char *ttyname) +pty_make_controlling_tty(int *ttyfd, const char *tty) { int fd; #ifdef USE_VHANGUP @@ -82,7 +82,7 @@ pty_make_controlling_tty(int *ttyfd, const char *ttyname) if (setsid() < 0) error("setsid: %.100s", strerror(errno)); - fd = open(ttyname, O_RDWR|O_NOCTTY); + fd = open(tty, O_RDWR|O_NOCTTY); if (fd != -1) { signal(SIGHUP, SIG_IGN); ioctl(fd, TCVHUP, (char *)NULL); @@ -97,7 +97,7 @@ pty_make_controlling_tty(int *ttyfd, const char *ttyname) ioctl(*ttyfd, TCSETCTTY, NULL); fd = open("/dev/tty", O_RDWR); if (fd < 0) - error("%.100s: %.100s", ttyname, strerror(errno)); + error("%.100s: %.100s", tty, strerror(errno)); close(*ttyfd); *ttyfd = fd; #else /* _UNICOS */ @@ -137,9 +137,9 @@ pty_make_controlling_tty(int *ttyfd, const char *ttyname) vhangup(); signal(SIGHUP, old); #endif /* USE_VHANGUP */ - fd = open(ttyname, O_RDWR); + fd = open(tty, O_RDWR); if (fd < 0) { - error("%.100s: %.100s", ttyname, strerror(errno)); + error("%.100s: %.100s", tty, strerror(errno)); } else { #ifdef USE_VHANGUP close(*ttyfd); @@ -174,7 +174,7 @@ pty_change_window_size(int ptyfd, int row, int col, } void -pty_setowner(struct passwd *pw, const char *ttyname) +pty_setowner(struct passwd *pw, const char *tty) { struct group *grp; gid_t gid; @@ -196,33 +196,33 @@ pty_setowner(struct passwd *pw, const char *ttyname) * Warn but continue if filesystem is read-only and the uids match/ * tty is owned by root. */ - if (stat(ttyname, &st)) - fatal("stat(%.100s) failed: %.100s", ttyname, + if (stat(tty, &st)) + fatal("stat(%.100s) failed: %.100s", tty, strerror(errno)); if (st.st_uid != pw->pw_uid || st.st_gid != gid) { - if (chown(ttyname, pw->pw_uid, gid) < 0) { + if (chown(tty, pw->pw_uid, gid) < 0) { if (errno == EROFS && (st.st_uid == pw->pw_uid || st.st_uid == 0)) debug("chown(%.100s, %u, %u) failed: %.100s", - ttyname, (u_int)pw->pw_uid, (u_int)gid, + tty, (u_int)pw->pw_uid, (u_int)gid, strerror(errno)); else fatal("chown(%.100s, %u, %u) failed: %.100s", - ttyname, (u_int)pw->pw_uid, (u_int)gid, + tty, (u_int)pw->pw_uid, (u_int)gid, strerror(errno)); } } if ((st.st_mode & (S_IRWXU|S_IRWXG|S_IRWXO)) != mode) { - if (chmod(ttyname, mode) < 0) { + if (chmod(tty, mode) < 0) { if (errno == EROFS && (st.st_mode & (S_IRGRP | S_IROTH)) == 0) debug("chmod(%.100s, 0%o) failed: %.100s", - ttyname, (u_int)mode, strerror(errno)); + tty, (u_int)mode, strerror(errno)); else fatal("chmod(%.100s, 0%o) failed: %.100s", - ttyname, (u_int)mode, strerror(errno)); + tty, (u_int)mode, strerror(errno)); } } } diff --git a/crypto/openssh/sshtty.h b/crypto/openssh/sshtty.h deleted file mode 100644 index 723b278..0000000 --- a/crypto/openssh/sshtty.h +++ /dev/null @@ -1,47 +0,0 @@ -/* $OpenBSD: sshtty.h,v 1.3 2003/09/19 17:43:35 markus Exp $ */ -/* - * Author: Tatu Ylonen <ylo@cs.hut.fi> - * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland - * All rights reserved - * - * As far as I am concerned, the code I have written for this software - * can be used freely for any purpose. Any derived versions of this - * software must be clearly marked as such, and if the derived work is - * incompatible with the protocol description in the RFC file, it must be - * called by a name other than "ssh" or "Secure Shell". - */ -/* - * Copyright (c) 2001 Markus Friedl. All rights reserved. - * Copyright (c) 2001 Kevin Steves. All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * - * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR - * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES - * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. - * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, - * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, - * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY - * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF - * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - */ - -#ifndef SSHTTY_H -#define SSHTTY_H - -#include <termios.h> - -struct termios get_saved_tio(void); -void leave_raw_mode(void); -void enter_raw_mode(void); - -#endif diff --git a/crypto/openssh/tildexpand.h b/crypto/openssh/tildexpand.h deleted file mode 100644 index f5e7e40..0000000 --- a/crypto/openssh/tildexpand.h +++ /dev/null @@ -1,15 +0,0 @@ -/* $OpenBSD: tildexpand.h,v 1.4 2001/06/26 17:27:25 markus Exp $ */ - -/* - * Author: Tatu Ylonen <ylo@cs.hut.fi> - * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland - * All rights reserved - * - * As far as I am concerned, the code I have written for this software - * can be used freely for any purpose. Any derived versions of this - * software must be clearly marked as such, and if the derived work is - * incompatible with the protocol description in the RFC file, it must be - * called by a name other than "ssh" or "Secure Shell". - */ - -char *tilde_expand_filename(const char *, uid_t); diff --git a/crypto/openssh/version.c b/crypto/openssh/version.c index a661439..cf2ad86 100644 --- a/crypto/openssh/version.c +++ b/crypto/openssh/version.c @@ -23,7 +23,6 @@ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * - * $FreeBSD$ */ #include "includes.h" diff --git a/crypto/openssh/version.h b/crypto/openssh/version.h index 7acdecb..45f66be 100644 --- a/crypto/openssh/version.h +++ b/crypto/openssh/version.h @@ -1,11 +1,11 @@ +/* $OpenBSD: version.h,v 1.42 2004/08/16 08:17:01 markus Exp $ */ /* $FreeBSD$ */ -/* $OpenBSD: version.h,v 1.40 2004/02/23 15:16:46 markus Exp $ */ #ifndef SSH_VERSION #define SSH_VERSION (ssh_version_get()) -#define SSH_VERSION_BASE "OpenSSH_3.8.1p1" -#define SSH_VERSION_ADDENDUM "FreeBSD-20040419" +#define SSH_VERSION_BASE "OpenSSH_3.9p1" +#define SSH_VERSION_ADDENDUM "FreeBSD-20041028" const char *ssh_version_get(void); void ssh_version_set_addendum(const char *add); |
