tyler.durden/openssh-portable
1
0
Fork 0
mirror of https://github.com/PowerShell/openssh-portable.git synced 2025-07-31 01:35:11 +02:00
Code Issues Packages Projects Releases Wiki Activity

upstream commit

Browse Source 
add prohibit-password as a synonymn for without-password,
 since the without-password is causing too many questions.  Harden it to ban
 all but pubkey, hostbased, and GSSAPI auth (when the latter is enabled) from
 djm, ok markus

Upstream-ID: d53317d7b28942153e6236d3fd6e12ceb482db7a
This commit is contained in:
deraadt@openbsd.org 2015-08-06 14:53:21 +00:00 committed by Damien Miller
parent 90a95a4745
commit 1dc8d93ce6
4 changed files with 15 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
auth.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: auth.c,v 1.111 2015/05/01 04:17:51 djm Exp $ */ /* $OpenBSD: auth.c,v 1.112 2015/08/06 14:53:21 deraadt Exp $ */
/* /*
* Copyright (c) 2000 Markus Friedl. All rights reserved. * Copyright (c) 2000 Markus Friedl. All rights reserved.
* *
@ -352,7 +352,9 @@ auth_root_allowed(const char *method)
case PERMIT_YES: case PERMIT_YES:
return 1; return 1;
case PERMIT_NO_PASSWD: case PERMIT_NO_PASSWD:
if (strcmp(method, "password") != 0) if (strcmp(method, "publickey") == 0 ||
strcmp(method, "hostbased") == 0 ||
strcmp(method, "gssapi-with-mic"))
return 1; return 1;
break; break;
case PERMIT_FORCED_ONLY: case PERMIT_FORCED_ONLY:

3
servconf.c
View File

@ -1,5 +1,5 @@
/* $OpenBSD: servconf.c,v 1.279 2015/07/31 15:38:09 chris Exp $ */ /* $OpenBSD: servconf.c,v 1.280 2015/08/06 14:53:21 deraadt Exp $ */
/* /*
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
* All rights reserved * All rights reserved
@ -916,6 +916,7 @@ static const struct multistate multistate_addressfamily[] = {
}; };
static const struct multistate multistate_permitrootlogin[] = { static const struct multistate multistate_permitrootlogin[] = {
{ "without-password", PERMIT_NO_PASSWD }, { "without-password", PERMIT_NO_PASSWD },
{ "prohibit-password", PERMIT_NO_PASSWD },
{ "forced-commands-only", PERMIT_FORCED_ONLY }, { "forced-commands-only", PERMIT_FORCED_ONLY },
{ "yes", PERMIT_YES }, { "yes", PERMIT_YES },
{ "no", PERMIT_NO }, { "no", PERMIT_NO },

4
sshd_config
View File

@ -1,4 +1,4 @@
# $OpenBSD: sshd_config,v 1.96 2015/07/30 19:23:02 deraadt Exp $ # $OpenBSD: sshd_config,v 1.97 2015/08/06 14:53:21 deraadt Exp $
# This is the sshd server system-wide configuration file. See # This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information. # sshd_config(5) for more information.
@ -41,7 +41,7 @@
# Authentication: # Authentication:
#LoginGraceTime 2m #LoginGraceTime 2m
#PermitRootLogin without-password #PermitRootLogin prohibit-password
#StrictModes yes #StrictModes yes
#MaxAuthTries 6 #MaxAuthTries 6
#MaxSessions 10 #MaxSessions 10

11
sshd_config.5
View File

@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\" .\"
.\" $OpenBSD: sshd_config.5,v 1.209 2015/07/30 19:23:02 deraadt Exp $ .\" $OpenBSD: sshd_config.5,v 1.210 2015/08/06 14:53:21 deraadt Exp $
.Dd $Mdocdate: July 30 2015 $ .Dd $Mdocdate: August 6 2015 $
.Dt SSHD_CONFIG 5 .Dt SSHD_CONFIG 5
.Os .Os
.Sh NAME .Sh NAME
@ -1204,16 +1204,19 @@ Specifies whether root can log in using
.Xr ssh 1 . .Xr ssh 1 .
The argument must be The argument must be
.Dq yes , .Dq yes ,
.Dq prohibit-password ,
.Dq without-password , .Dq without-password ,
.Dq forced-commands-only , .Dq forced-commands-only ,
or or
.Dq no . .Dq no .
The default is The default is
.Dq without-password . .Dq prohibit-password .
.Pp .Pp
If this option is set to If this option is set to
.Dq prohibit-password
or
.Dq without-password , .Dq without-password ,
password authentication is disabled for root. password and keyboard-interactive authentication are disabled for root.
.Pp .Pp
If this option is set to If this option is set to
.Dq forced-commands-only , .Dq forced-commands-only ,