Merge branch 'master' of https://github.com/openssh/openssh-portable into latestw
This commit is contained in:
Manoj Ampalam
commit
78995b5a42
|
|
@ -63,7 +63,6 @@ sshd_config_configured=no
|
|||
port_number=22
|
||||
service_name=sshd
|
||||
strictmodes=yes
|
||||
privsep_used=yes
|
||||
cygwin_value=""
|
||||
user_account=
|
||||
password_value=
|
||||
|
|
@ -140,33 +139,21 @@ sshd_strictmodes() {
|
|||
|
||||
# ======================================================================
|
||||
# Routine: sshd_privsep
|
||||
# MODIFIES: privsep_used
|
||||
# Try to create ssshd user account
|
||||
# ======================================================================
|
||||
sshd_privsep() {
|
||||
local ret=0
|
||||
|
||||
if [ "${sshd_config_configured}" != "yes" ]
|
||||
then
|
||||
echo
|
||||
csih_inform "Privilege separation is set to 'sandbox' by default since"
|
||||
csih_inform "OpenSSH 6.1. This is unsupported by Cygwin and has to be set"
|
||||
csih_inform "to 'yes' or 'no'."
|
||||
csih_inform "However, using privilege separation requires a non-privileged account"
|
||||
csih_inform "called 'sshd'."
|
||||
csih_inform "For more info on privilege separation read /usr/share/doc/openssh/README.privsep."
|
||||
if csih_request "Should privilege separation be used?"
|
||||
if ! csih_create_unprivileged_user sshd
|
||||
then
|
||||
privsep_used=yes
|
||||
if ! csih_create_unprivileged_user sshd
|
||||
then
|
||||
csih_error_recoverable "Couldn't create user 'sshd'!"
|
||||
csih_error_recoverable "Privilege separation set to 'no' again!"
|
||||
csih_error_recoverable "Check your ${SYSCONFDIR}/sshd_config file!"
|
||||
let ++ret
|
||||
privsep_used=no
|
||||
fi
|
||||
else
|
||||
privsep_used=no
|
||||
csih_error_recoverable "Could not create user 'sshd'!"
|
||||
csih_error_recoverable "You will not be able to run an sshd service"
|
||||
csih_error_recoverable "under a privileged account successfully."
|
||||
csih_error_recoverable "Make sure to create a non-privileged user 'sshd'"
|
||||
csih_error_recoverable "manually before trying to run the service!"
|
||||
let ++ret
|
||||
fi
|
||||
fi
|
||||
return $ret
|
||||
|
|
@ -202,18 +189,6 @@ sshd_config_tweak() {
|
|||
let ++ret
|
||||
fi
|
||||
fi
|
||||
if [ "${sshd_config_configured}" != "yes" ]
|
||||
then
|
||||
/usr/bin/sed -i -e "
|
||||
s/^#\?UsePrivilegeSeparation .*/UsePrivilegeSeparation ${privsep_used}/" \
|
||||
${SYSCONFDIR}/sshd_config
|
||||
if [ $? -ne 0 ]
|
||||
then
|
||||
csih_warning "Setting privilege separation failed!"
|
||||
csih_warning "Check your ${SYSCONFDIR}/sshd_config file!"
|
||||
let ++ret
|
||||
fi
|
||||
fi
|
||||
return $ret
|
||||
} # --- End of sshd_config_tweak --- #
|
||||
|
||||
|
|
@ -693,7 +668,7 @@ then
|
|||
fi
|
||||
fi
|
||||
|
||||
# handle sshd_config (and privsep)
|
||||
# handle sshd_config
|
||||
csih_install_config "${SYSCONFDIR}/sshd_config" "${SYSCONFDIR}/defaults" || let ++warning_cnt
|
||||
if ! /usr/bin/cmp "${SYSCONFDIR}/sshd_config" "${SYSCONFDIR}/defaults/${SYSCONFDIR}/sshd_config" >/dev/null 2>&1
|
||||
then
|
||||
|
|
|
|||
|
|
@ -5,10 +5,14 @@
|
|||
* Placed in the public domain
|
||||
*/
|
||||
|
||||
#include "includes.h"
|
||||
|
||||
#include <sys/types.h>
|
||||
#include <sys/param.h>
|
||||
#include <stdio.h>
|
||||
#ifdef HAVE_STDINT_H
|
||||
#include <stdint.h>
|
||||
#endif
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
|
|
|
|||
12
servconf.c
12
servconf.c
|
|
@ -1,5 +1,5 @@
|
|||
|
||||
/* $OpenBSD: servconf.c,v 1.305 2017/03/10 04:11:00 dtucker Exp $ */
|
||||
/* $OpenBSD: servconf.c,v 1.306 2017/03/14 07:19:07 djm Exp $ */
|
||||
/*
|
||||
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
|
||||
* All rights reserved
|
||||
|
|
@ -535,7 +535,7 @@ static struct {
|
|||
{ "clientalivecountmax", sClientAliveCountMax, SSHCFG_ALL },
|
||||
{ "authorizedkeysfile", sAuthorizedKeysFile, SSHCFG_ALL },
|
||||
{ "authorizedkeysfile2", sDeprecated, SSHCFG_ALL },
|
||||
{ "useprivilegeseparation", sUsePrivilegeSeparation, SSHCFG_GLOBAL},
|
||||
{ "useprivilegeseparation", sDeprecated, SSHCFG_GLOBAL},
|
||||
{ "acceptenv", sAcceptEnv, SSHCFG_ALL },
|
||||
{ "permittunnel", sPermitTunnel, SSHCFG_ALL },
|
||||
{ "permittty", sPermitTTY, SSHCFG_ALL },
|
||||
|
|
@ -1379,11 +1379,6 @@ process_server_config_line(ServerOptions *options, char *line,
|
|||
intptr = &options->disable_forwarding;
|
||||
goto parse_flag;
|
||||
|
||||
case sUsePrivilegeSeparation:
|
||||
intptr = &use_privsep;
|
||||
multistate_ptr = multistate_privsep;
|
||||
goto parse_multistate;
|
||||
|
||||
case sAllowUsers:
|
||||
while ((arg = strdelim(&cp)) && *arg != '\0') {
|
||||
if (options->num_allow_users >= MAX_ALLOW_USERS)
|
||||
|
|
@ -2112,8 +2107,6 @@ fmt_intarg(ServerOpCodes code, int val)
|
|||
return fmt_multistate_int(val, multistate_gatewayports);
|
||||
case sCompression:
|
||||
return fmt_multistate_int(val, multistate_compression);
|
||||
case sUsePrivilegeSeparation:
|
||||
return fmt_multistate_int(val, multistate_privsep);
|
||||
case sAllowTcpForwarding:
|
||||
return fmt_multistate_int(val, multistate_tcpfwd);
|
||||
case sAllowStreamLocalForwarding:
|
||||
|
|
@ -2289,7 +2282,6 @@ dump_config(ServerOptions *o)
|
|||
dump_cfg_fmtint(sDisableForwarding, o->disable_forwarding);
|
||||
dump_cfg_fmtint(sAllowStreamLocalForwarding, o->allow_streamlocal_forwarding);
|
||||
dump_cfg_fmtint(sStreamLocalBindUnlink, o->fwd_opts.streamlocal_bind_unlink);
|
||||
dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
|
||||
dump_cfg_fmtint(sFingerprintHash, o->fingerprint_hash);
|
||||
|
||||
/* string arguments */
|
||||
|
|
|
|||
16
ssh-agent.c
16
ssh-agent.c
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: ssh-agent.c,v 1.216 2017/01/04 02:21:43 djm Exp $ */
|
||||
/* $OpenBSD: ssh-agent.c,v 1.218 2017/03/15 03:52:30 deraadt Exp $ */
|
||||
/*
|
||||
* Author: Tatu Ylonen <ylo@cs.hut.fi>
|
||||
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
|
||||
|
|
@ -821,7 +821,7 @@ send:
|
|||
static void
|
||||
process_remove_smartcard_key(SocketEntry *e)
|
||||
{
|
||||
char *provider = NULL, *pin = NULL;
|
||||
char *provider = NULL, *pin = NULL, canonical_provider[PATH_MAX];
|
||||
int r, version, success = 0;
|
||||
Identity *id, *nxt;
|
||||
Idtab *tab;
|
||||
|
|
@ -831,6 +831,13 @@ process_remove_smartcard_key(SocketEntry *e)
|
|||
fatal("%s: buffer error: %s", __func__, ssh_err(r));
|
||||
free(pin);
|
||||
|
||||
if (realpath(provider, canonical_provider) == NULL) {
|
||||
verbose("failed PKCS#11 add of \"%.100s\": realpath: %s",
|
||||
provider, strerror(errno));
|
||||
goto send;
|
||||
}
|
||||
|
||||
debug("%s: remove %.100s", __func__, canonical_provider);
|
||||
for (version = 1; version < 3; version++) {
|
||||
tab = idtab_lookup(version);
|
||||
for (id = TAILQ_FIRST(&tab->idlist); id; id = nxt) {
|
||||
|
|
@ -838,18 +845,19 @@ process_remove_smartcard_key(SocketEntry *e)
|
|||
/* Skip file--based keys */
|
||||
if (id->provider == NULL)
|
||||
continue;
|
||||
if (!strcmp(provider, id->provider)) {
|
||||
if (!strcmp(canonical_provider, id->provider)) {
|
||||
TAILQ_REMOVE(&tab->idlist, id, next);
|
||||
free_identity(id);
|
||||
tab->nentries--;
|
||||
}
|
||||
}
|
||||
}
|
||||
if (pkcs11_del_provider(provider) == 0)
|
||||
if (pkcs11_del_provider(canonical_provider) == 0)
|
||||
success = 1;
|
||||
else
|
||||
error("process_remove_smartcard_key:"
|
||||
" pkcs11_del_provider failed");
|
||||
send:
|
||||
free(provider);
|
||||
send_status(e, success);
|
||||
}
|
||||
|
|
|
|||
11
sshd.c
11
sshd.c
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: sshd.c,v 1.483 2017/02/24 03:16:34 djm Exp $ */
|
||||
/* $OpenBSD: sshd.c,v 1.485 2017/03/15 03:52:30 deraadt Exp $ */
|
||||
/*
|
||||
* Author: Tatu Ylonen <ylo@cs.hut.fi>
|
||||
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
|
||||
|
|
@ -1755,6 +1755,15 @@ main(int ac, char **av)
|
|||
continue;
|
||||
key = key_load_private(options.host_key_files[i], "", NULL);
|
||||
pubkey = key_load_public(options.host_key_files[i], NULL);
|
||||
|
||||
if ((pubkey != NULL && pubkey->type == KEY_RSA1) ||
|
||||
(key != NULL && key->type == KEY_RSA1)) {
|
||||
verbose("Ignoring RSA1 key %s",
|
||||
options.host_key_files[i]);
|
||||
key_free(key);
|
||||
key_free(pubkey);
|
||||
continue;
|
||||
}
|
||||
if (pubkey == NULL && key != NULL)
|
||||
pubkey = key_demote(key);
|
||||
sensitive_data.host_keys[i] = key;
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# $OpenBSD: sshd_config,v 1.100 2016/08/15 12:32:04 naddy Exp $
|
||||
# $OpenBSD: sshd_config,v 1.101 2017/03/14 07:19:07 djm Exp $
|
||||
|
||||
# This is the sshd server system-wide configuration file. See
|
||||
# sshd_config(5) for more information.
|
||||
|
|
@ -93,7 +93,6 @@ AuthorizedKeysFile .ssh/authorized_keys
|
|||
#PrintLastLog yes
|
||||
#TCPKeepAlive yes
|
||||
#UseLogin no
|
||||
#UsePrivilegeSeparation sandbox
|
||||
#PermitUserEnvironment no
|
||||
#Compression delayed
|
||||
#ClientAliveInterval 0
|
||||
|
|
|
|||
|
|
@ -33,8 +33,8 @@
|
|||
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
.\"
|
||||
.\" $OpenBSD: sshd_config.5,v 1.242 2017/02/03 23:01:19 djm Exp $
|
||||
.Dd $Mdocdate: February 3 2017 $
|
||||
.\" $OpenBSD: sshd_config.5,v 1.243 2017/03/14 07:19:07 djm Exp $
|
||||
.Dd $Mdocdate: March 14 2017 $
|
||||
.Dt SSHD_CONFIG 5
|
||||
.Os
|
||||
.Sh NAME
|
||||
|
|
@ -1494,28 +1494,6 @@ is enabled, you will not be able to run
|
|||
as a non-root user.
|
||||
The default is
|
||||
.Cm no .
|
||||
.It Cm UsePrivilegeSeparation
|
||||
Specifies whether
|
||||
.Xr sshd 8
|
||||
separates privileges by creating an unprivileged child process
|
||||
to deal with incoming network traffic.
|
||||
After successful authentication, another process will be created that has
|
||||
the privilege of the authenticated user.
|
||||
The goal of privilege separation is to prevent privilege
|
||||
escalation by containing any corruption within the unprivileged processes.
|
||||
The argument must be
|
||||
.Cm yes ,
|
||||
.Cm no ,
|
||||
or
|
||||
.Cm sandbox .
|
||||
If
|
||||
.Cm UsePrivilegeSeparation
|
||||
is set to
|
||||
.Cm sandbox
|
||||
then the pre-authentication unprivileged process is subject to additional
|
||||
restrictions.
|
||||
The default is
|
||||
.Cm sandbox .
|
||||
.It Cm VersionAddendum
|
||||
Optionally specifies additional text to append to the SSH protocol banner
|
||||
sent by the server upon connection.
|
||||
|
|
|
|||
Loading…
Reference in New Issue