tyler.durden
/
openssh-portable
mirror of https://github.com/PowerShell/openssh-portable.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

tighten PAM monitor calls 

only allow kbd-interactive ones when that authentication method is
enabled. Prompted by Solar Designer
This commit is contained in:
Damien Miller 2016-08-31 10:48:07 +10:00
parent 7fd0ea8a1d
commit 775f8a23f2
1 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
monitor.c
View File

@ -996,6 +996,7 @@ mm_answer_pam_start(int sock, Buffer *m)
start_pam(authctxt); start_pam(authctxt);
monitor_permit(mon_dispatch, MONITOR_REQ_PAM_ACCOUNT, 1); monitor_permit(mon_dispatch, MONITOR_REQ_PAM_ACCOUNT, 1);
if (options.kbd_interactive_authentication)
monitor_permit(mon_dispatch, MONITOR_REQ_PAM_INIT_CTX, 1); monitor_permit(mon_dispatch, MONITOR_REQ_PAM_INIT_CTX, 1);
return (0); return (0);
@ -1007,7 +1008,7 @@ mm_answer_pam_account(int sock, Buffer *m)
u_int ret; u_int ret;
if (!options.use_pam) if (!options.use_pam)
fatal("UsePAM not set, but ended up in %s anyway", __func__); fatal("%s: PAM not enabled", __func__);
ret = do_pam_account(); ret = do_pam_account();
@ -1026,6 +1027,8 @@ int
mm_answer_pam_init_ctx(int sock, Buffer *m) mm_answer_pam_init_ctx(int sock, Buffer *m)
{ {
debug3("%s", __func__); debug3("%s", __func__);
if (!options.kbd_interactive_authentication)
fatal("%s: kbd-int authentication not enabled", __func__);
if (sshpam_ctxt != NULL) if (sshpam_ctxt != NULL)
fatal("%s: already called", __func__); fatal("%s: already called", __func__);
sshpam_ctxt = (sshpam_device.init_ctx)(authctxt); sshpam_ctxt = (sshpam_device.init_ctx)(authctxt);
@ -1053,7 +1056,8 @@ mm_answer_pam_query(int sock, Buffer *m)
sshpam_authok = NULL; sshpam_authok = NULL;
if (sshpam_ctxt == NULL) if (sshpam_ctxt == NULL)
fatal("%s: no context", __func__); fatal("%s: no context", __func__);
ret = (sshpam_device.query)(sshpam_ctxt, &name, &info, &num, &prompts, &echo_on); ret = (sshpam_device.query)(sshpam_ctxt, &name, &info,
&num, &prompts, &echo_on);
if (ret == 0 && num == 0) if (ret == 0 && num == 0)
sshpam_authok = sshpam_ctxt; sshpam_authok = sshpam_ctxt;
if (num > 1 || name == NULL || info == NULL) if (num > 1 || name == NULL || info == NULL)