tyler.durden
/
openssh-portable
mirror of https://github.com/PowerShell/openssh-portable.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

- djm@cvs.openbsd.org 2008/03/26 21:28:14 

[auth-options.c auth-options.h session.c sshd.8]
     add no-user-rc authorized_keys option to disable execution of ~/.ssh/rc
This commit is contained in:
Damien Miller 2008-03-27 11:03:05 +11:00
parent 55360e1ceb
commit 95e80955f2
5 changed files with 23 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
ChangeLog
View File

@ -40,6 +40,9 @@
- djm@cvs.openbsd.org 2008/03/25 23:01:41 - djm@cvs.openbsd.org 2008/03/25 23:01:41
[session.c] [session.c]
last patch had backwards test; spotted by termim AT gmail.com last patch had backwards test; spotted by termim AT gmail.com
- djm@cvs.openbsd.org 2008/03/26 21:28:14
[auth-options.c auth-options.h session.c sshd.8]
add no-user-rc authorized_keys option to disable execution of ~/.ssh/rc
20080315 20080315
- (djm) [regress/test-exec.sh] Quote putty-related variables in case they are - (djm) [regress/test-exec.sh] Quote putty-related variables in case they are
@ -3808,4 +3811,4 @@
OpenServer 6 and add osr5bigcrypt support so when someone migrates OpenServer 6 and add osr5bigcrypt support so when someone migrates
passwords between UnixWare and OpenServer they will still work. OK dtucker@ passwords between UnixWare and OpenServer they will still work. OK dtucker@
$Id: ChangeLog,v 1.4888 2008/03/27 00:02:27 djm Exp $ $Id: ChangeLog,v 1.4889 2008/03/27 00:03:05 djm Exp $

11
auth-options.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: auth-options.c,v 1.40 2006/08/03 03:34:41 deraadt Exp $ */ /* $OpenBSD: auth-options.c,v 1.41 2008/03/26 21:28:14 djm Exp $ */
/* /*
* Author: Tatu Ylonen <ylo@cs.hut.fi> * Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -42,6 +42,7 @@ int no_port_forwarding_flag = 0;
int no_agent_forwarding_flag = 0; int no_agent_forwarding_flag = 0;
int no_x11_forwarding_flag = 0; int no_x11_forwarding_flag = 0;
int no_pty_flag = 0; int no_pty_flag = 0;
int no_user_rc = 0;
/* "command=" option. */ /* "command=" option. */
char *forced_command = NULL; char *forced_command = NULL;
@ -61,6 +62,7 @@ auth_clear_options(void)
no_port_forwarding_flag = 0; no_port_forwarding_flag = 0;
no_pty_flag = 0; no_pty_flag = 0;
no_x11_forwarding_flag = 0; no_x11_forwarding_flag = 0;
no_user_rc = 0;
while (custom_environment) { while (custom_environment) {
struct envstring *ce = custom_environment; struct envstring *ce = custom_environment;
custom_environment = ce->next; custom_environment = ce->next;
@ -121,6 +123,13 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
opts += strlen(cp); opts += strlen(cp);
goto next_option; goto next_option;
} }
cp = "no-user-rc";
if (strncasecmp(opts, cp, strlen(cp)) == 0) {
auth_debug_add("User rc file execution disabled.");
no_user_rc = 1;
opts += strlen(cp);
goto next_option;
}
cp = "command=\""; cp = "command=\"";
if (strncasecmp(opts, cp, strlen(cp)) == 0) { if (strncasecmp(opts, cp, strlen(cp)) == 0) {
opts += strlen(cp); opts += strlen(cp);

3
auth-options.h
View File

@ -1,4 +1,4 @@
/* $OpenBSD: auth-options.h,v 1.16 2006/08/03 03:34:41 deraadt Exp $ */ /* $OpenBSD: auth-options.h,v 1.17 2008/03/26 21:28:14 djm Exp $ */
/* /*
* Author: Tatu Ylonen <ylo@cs.hut.fi> * Author: Tatu Ylonen <ylo@cs.hut.fi>
@ -26,6 +26,7 @@ extern int no_port_forwarding_flag;
extern int no_agent_forwarding_flag; extern int no_agent_forwarding_flag;
extern int no_x11_forwarding_flag; extern int no_x11_forwarding_flag;
extern int no_pty_flag; extern int no_pty_flag;
extern int no_user_rc;
extern char *forced_command; extern char *forced_command;
extern struct envstring *custom_environment; extern struct envstring *custom_environment;
extern int forced_tun_device; extern int forced_tun_device;

4
session.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: session.c,v 1.232 2008/03/25 23:01:41 djm Exp $ */ /* $OpenBSD: session.c,v 1.233 2008/03/26 21:28:14 djm Exp $ */
/* /*
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
* All rights reserved * All rights reserved
@ -1204,7 +1204,7 @@ do_rc_files(Session *s, const char *shell)
/* ignore _PATH_SSH_USER_RC for subsystems and admin forced commands */ /* ignore _PATH_SSH_USER_RC for subsystems and admin forced commands */
if (!s->is_subsystem && options.adm_forced_command == NULL && if (!s->is_subsystem && options.adm_forced_command == NULL &&
(stat(_PATH_SSH_USER_RC, &st) >= 0)) { !no_user_rc && (stat(_PATH_SSH_USER_RC, &st) >= 0)) {
snprintf(cmd, sizeof cmd, "%s -c '%s %s'", snprintf(cmd, sizeof cmd, "%s -c '%s %s'",
shell, _PATH_BSHELL, _PATH_SSH_USER_RC); shell, _PATH_BSHELL, _PATH_SSH_USER_RC);
if (debug_flag) if (debug_flag)

7
sshd.8
View File

@ -34,8 +34,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\" .\"
.\" $OpenBSD: sshd.8,v 1.239 2008/02/11 07:58:28 jmc Exp $ .\" $OpenBSD: sshd.8,v 1.240 2008/03/26 21:28:14 djm Exp $
.Dd $Mdocdate: February 11 2008 $ .Dd $Mdocdate: March 26 2008 $
.Dt SSHD 8 .Dt SSHD 8
.Os .Os
.Sh NAME .Sh NAME
@ -531,6 +531,9 @@ This might be used, e.g. in connection with the
option. option.
.It Cm no-pty .It Cm no-pty
Prevents tty allocation (a request to allocate a pty will fail). Prevents tty allocation (a request to allocate a pty will fail).
.It Cm no-user-rc
Disables execution of
.Pa ~/.ssh/rc .
.It Cm no-X11-forwarding .It Cm no-X11-forwarding
Forbids X11 forwarding when this key is used for authentication. Forbids X11 forwarding when this key is used for authentication.
Any X11 forward requests by the client will return an error. Any X11 forward requests by the client will return an error.