summaryrefslogtreecommitdiffstats
path: root/crypto/openssh
Commit message (Collapse)AuthorAgeFilesLines
* Paranoia: instead of a NULL conversation function, use one that alwaysdes2003-02-161-6/+24
| | | | | | | | returns PAM_CONV_ERR; moreover, make sure we always have the right conversation function installed before calling PAM service functions. Also unwrap some not-so-long lines. MFC after: 3 days
* document the current default value for VersionAddendum.des2003-02-114-4/+4
|
* Set the ruid to the euid at startup as a workaround for a bug in pam_ssh.des2003-02-071-0/+1
| | | | MFC after: 3 days
* The manual page lists only 2 files, however it reads as `three files' which istrhodes2003-02-051-2/+2
| | | | | | | obviously incorrect. PR: 46841 Submitted by: Sakamoto Seiji <s-siji@hyper.ocn.ne.jp>
* Linux-PAM's pam_start(3) fails with a bogus error message if passed thedes2003-02-031-1/+2
| | | | | | | | pam_conv argument is NULL. OpenPAM doesn't care, but to make things easier for people porting this code to other systems (or -STABLE), use a dummy struct pam_conv instead of NULL. Pointed out by: Damien Miller <djm@mindrot.org>
* Bump patch date to 2003-02-01 (the day after I fixed PAM authenticationdes2003-02-031-1/+1
| | | | for ssh1)
* Fix keyboard-interactive authentication for ssh1. The problem was twofold:des2003-01-312-0/+21
| | | | | | | | | | | | | | | | - The PAM kbdint device sometimes doesn't know authentication succeeded until you re-query it. The ssh1 kbdint code would never re-query the device, so authentication would always fail. This patch has been submitted to the OpenSSH developers. - The monitor code for PAM sometimes forgot to tell the monitor that authentication had succeeded. This caused the monitor to veto the privsep child's decision to allow the connection. These patches have been tested with OpenSSH clients on -STABLE, NetBSD and Linux, and with ssh.com's ssh1 on Solaris. Sponsored by: DARPA, NAI Labs
* Force early initialization of the resolver library, since the resolverdes2003-01-221-0/+15
| | | | | | | | configuration files will no longer be available once sshd is chrooted. PR: 39953, 40894 Submitted by: dinoex MFC after: 3 days
* The previous commit contained a stupid mistake: ctxt->pam_[cp]sock wasdes2002-12-211-2/+2
| | | | | | initialized after the call to pthread_create() instead of before. It just happened to work with threads enabled because ctxt is shared, but of course it doesn't work when we use a child process instead of threads.
* If possible, use pthreads instead of a child process for PAM.des2002-12-142-65/+334
| | | | | | | | | | | Reimplement the necessary bits from auth_pam.c and auth2_pam.c so that they share the PAM context used by the keyboard-interactive thread. If a child process is used instead, they will (necessarily) use a separate context. Constify do_pam_account() and do_pam_session(). Sponsored by: DARPA, NAI Labs
* Add a missing #include "canohost.h".des2002-12-141-0/+1
|
* Remove code related to the PAMAuthenticationViaKbdInt option (which we'vedes2002-12-141-4/+1
| | | | disabled). This removes the only reference to auth2_pam().
* Back out a lastlog-related change which is no longer relevant.des2002-12-141-1/+1
|
* Fix a rounding error in the block size calculation.des2002-12-141-2/+2
| | | | Submitted by: tjr
* Since OpenSSH drops privileges before calling pam_open_session(3),des2002-12-032-170/+202
| | | | | | pam_lastlog(8) can't possibly work, so let OpenSSH handle lastlog. Approved by: re (rwatson)
* Add caveats regarding the effect of PAM on PasswordAuthentication anddes2002-11-061-0/+23
| | | | | | | PermitRootLogin. PR: docs/43776 MFC after: 1 week
* Document the current default for VersionAddendum.des2002-11-051-0/+2
|
* Accurately reflect our local changes and additions.des2002-11-051-11/+9
|
* Document the current default value for VersionAddendum.des2002-11-052-2/+2
|
* Switch to two-clause license, with NAI's permission.des2002-11-021-3/+0
|
* Resolve conflicts.des2002-10-2957-526/+1253
|
* Protect against tag expansion + fix some brainos.des2002-10-291-6/+6
|
* Some tricks I use when I upgrade.des2002-10-291-0/+20
|
* Correct shell code to expand globs in FREEBSD-Xlistdes2002-10-291-1/+1
|
* More cruft.des2002-10-291-0/+2
|
* This commit was generated by cvs2svn to compensate for changes in r106121,des2002-10-2978-1597/+3674
|\ | | | | | | which included commits to RCS files with non-trunk default branches.
| * Vendor import of OpenSSH-portable 3.5p1.des2002-10-29133-2117/+4911
| |
* | sshd didn't handle actual size of struct sockaddr correctly,ume2002-09-094-12/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | and did copy it as long as just size of struct sockaddr. So, If connection is via IPv6, sshd didn't log hostname into utmp correctly. This problem occured only under FreeBSD because of our hack. However, this is potential problem of OpenSSH-portable, and they agreed to fix this. Though, there is no fixed version of OpenSSH-portable available yet, since this problem is serious for IPv6 users, I commit the fix. Reported by: many people Reviewed by: current@ and stable@ (no objection) MFC after: 3 days
* | Fix typo (s@src/crypto/openssh-portable@src/crypto/openssh@).kuriyama2002-09-091-1/+1
| |
* | Do login cap calls _before_ descriptors are hardly closed because close mayache2002-08-051-1/+8
| | | | | | | | | | | | invalidate login cap descriptor. Reviewed by: des
* | Use login_getpwclass() instead of login_getclass() so that the rootfanf2002-07-291-1/+2
| | | | | | | | | | | | | | | | vs. default login class distinction is made correctly. PR: 37416 Approved by: des MFC after: 4 days
* | FreeBSD doesn't use the host RSA key by default.fanf2002-07-263-7/+2
| | | | | | | | Reviewed by: des
* | Problems addressed:ache2002-07-261-2/+21
| | | | | | | | | | | | | | | | | | 1) options.print_lastlog was not honored. 2) "Last login: ..." was printed twice. 3) "copyright" was not printed 4) No newline was before motd. Reviewed by: maintainer's silence in 2 weeks (with my constant reminders)
* | Document the FreeBSD default for CheckHostIP, which was changed infanf2002-07-252-2/+2
| | | | | | | | | | | | rev 1.2 of readconf.c. Approved by: des
* | Whitespace nit.des2002-07-231-1/+1
| |
* | In pam_init_ctx(), register a cleanup function that will kill the childdes2002-07-171-0/+13
| | | | | | | | process if a fatal error occurs. Deregister it in pam_free_ctx().
* | Use realhostname_sa(3) so the IP address will be used instead of thedes2002-07-111-1/+3
| | | | | | | | | | | | | | hostname if the latter is too long for utmp. Submitted by: ru MFC after: 3 days
* | Do not try to use PAM for password authentication, as it isdes2002-07-101-0/+8
| | | | | | | | | | already (and far better) supported by the challenge/response authentication mechanism.
* | Don't forget to clear the buffer before reusing it.des2002-07-101-0/+1
| |
* | Rewrite to use the buffer API instead of roll-your-own messaging.des2002-07-051-116/+65
| | | | | | | | | | Suggested by: Markus Friedl <markus@openbsd.org> Sponsored by: DARPA, NAI Labs
* | (forgot to commit) We don't need --with-opie since PAM takes care of it.des2002-07-051-1/+1
| |
* | - Don't enable OpenSSH's OPIE support, since we let PAM handle OPIE.des2002-07-031-6/+6
| | | | | | | | | | - We don't have setutent(3) etc., and I have no idea why configure ever thought we did.
* | Two FreeBSD-specific nits in comments:des2002-07-031-5/+1
| | | | | | | | | | | | | | | | - ChallengeResponseAuthentication controls PAM, not S/Key - We don't honor PAMAuthenticationViaKbdInt, because the code path it controls doesn't make sense for us, so don't mention it. Sponsored by: DARPA, NAI Labs
* | Version bump for mm_answer_pam_respond() fix.des2002-07-021-1/+1
| |
* | Fix a braino in mm_answer_pam_respond() which would cause sshd to abort ifdes2002-07-021-1/+1
| | | | | | | | PAM authentication failed due to an incorrect response.
* | Forgot to update the addendum in the config files.des2002-06-302-2/+2
| |
* | Regenerate.des2002-06-291-4/+7
| |
* | <sys/mman.h> requires <sys/types.h>.des2002-06-291-0/+1
| |
* | Resolve conflicts.des2002-06-2927-198/+336
| | | | | | | | Sponsored by: DARPA, NAI Labs
* | This commit was generated by cvs2svn to compensate for changes in r99060,des2002-06-2928-184/+374
|\ \ | |/ | | | | which included commits to RCS files with non-trunk default branches.
OpenPOWER on IntegriCloud