Accepting request 398802 from home:pcerny:factory
- upgrade to 7.2p2 - changing license to 2-clause BSD to match source - enable trusted X11 forwarding by default [-X11_trusted_forwarding] - set UID for lastlog properly [-lastlog] - enable use of PAM by default [-enable_PAM_by_default] - copy command line arguments properly [-saveargv-fix] - do not use pthreads in PAM code [-dont_use_pthreads_in_PAM] - fix paths in documentation [-eal3] - prevent race consitions triggered by SIGALRM [-blocksigalrm] - do send and accept locale environment variables by default [-send_locale] - handle hostnames changes during X forwarding [-hostname_changes_when_forwarding_X] - try to remove xauth cookies on exit [-remove_xauth_cookies_on_exit] - properly format pts names for ?tmp? log files [-pts_names_formatting] - check locked accounts when using PAM [-pam_check_locks] - chenge default PermitRootLogin to 'yes' to prevent unwanted surprises on updates from older versions. See README.SUSE for details [-allow_root_password_login] - Disable DH parameters under 2048 bits by default and allow lowering the limit back to the RFC 4419 specified minimum through an option (bsc#932483, bsc#948902) [-disable_short_DH_parameters] - Add getuid() and stat() syscalls to the seccomp filter OBS-URL: https://build.opensuse.org/request/show/398802 OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=103
This commit is contained in:
parent
252ed8ae18
commit
5093e42eaa
@ -1,34 +0,0 @@
|
|||||||
References: https://lists.mindrot.org/pipermail/openssh-unix-announce/2016-January/000124.html https://bugzilla.suse.com/show_bug.cgi?id=961645 https://bugzilla.suse.com/show_bug.cgi?id=961642
|
|
||||||
--- readconf.c 30 Jul 2015 00:01:34 -0000 1.239
|
|
||||||
+++ readconf.c 13 Jan 2016 23:17:23 -0000
|
|
||||||
@@ -1648,7 +1648,7 @@ initialize_options(Options * options)
|
|
||||||
options->tun_remote = -1;
|
|
||||||
options->local_command = NULL;
|
|
||||||
options->permit_local_command = -1;
|
|
||||||
- options->use_roaming = -1;
|
|
||||||
+ options->use_roaming = 0;
|
|
||||||
options->visual_host_key = -1;
|
|
||||||
options->ip_qos_interactive = -1;
|
|
||||||
options->ip_qos_bulk = -1;
|
|
||||||
@@ -1819,8 +1819,7 @@ fill_default_options(Options * options)
|
|
||||||
options->tun_remote = SSH_TUNID_ANY;
|
|
||||||
if (options->permit_local_command == -1)
|
|
||||||
options->permit_local_command = 0;
|
|
||||||
- if (options->use_roaming == -1)
|
|
||||||
- options->use_roaming = 1;
|
|
||||||
+ options->use_roaming = 0;
|
|
||||||
if (options->visual_host_key == -1)
|
|
||||||
options->visual_host_key = 0;
|
|
||||||
if (options->ip_qos_interactive == -1)
|
|
||||||
--- ssh.c 30 Jul 2015 00:01:34 -0000 1.420
|
|
||||||
+++ ssh.c 13 Jan 2016 23:17:23 -0000
|
|
||||||
@@ -1882,9 +1882,6 @@ ssh_session2(void)
|
|
||||||
fork_postauth();
|
|
||||||
}
|
|
||||||
|
|
||||||
- if (options.use_roaming)
|
|
||||||
- request_roaming();
|
|
||||||
-
|
|
||||||
return client_loop(tty_flag, tty_flag ?
|
|
||||||
options.escape_char : SSH_ESCAPECHAR_NONE, id);
|
|
||||||
}
|
|
0
README.FIPS
Normal file
0
README.FIPS
Normal file
17
README.SUSE
Normal file
17
README.SUSE
Normal file
@ -0,0 +1,17 @@
|
|||||||
|
This is OpenSSH version 7.2p2 for SLE12
|
||||||
|
|
||||||
|
There are following changes in default settings of ssh client and server:
|
||||||
|
|
||||||
|
* Accepting and sending of locale environment variables in protocol 2 is
|
||||||
|
enabled.
|
||||||
|
|
||||||
|
* PAM authentication is enabled.
|
||||||
|
|
||||||
|
* root authentiation with password is enabled by default (PermitRootLogin yes).
|
||||||
|
NOTE: this has security implications and is only done in order to not change
|
||||||
|
behaviour of the server in an update. We strongly suggest setting this option
|
||||||
|
either "prohibit-password" or even better to "no" (which disables direct
|
||||||
|
remote root login entirely).
|
||||||
|
|
||||||
|
For more information on differences in SUSE OpenSSH package see README.FIPS
|
||||||
|
|
15
README.SuSE
15
README.SuSE
@ -1,15 +0,0 @@
|
|||||||
This is OpenSSH version 5.6p1.
|
|
||||||
|
|
||||||
There are following changes in default settings of ssh client:
|
|
||||||
|
|
||||||
* Accepting and sending of locale environment variables in protocol 2 is
|
|
||||||
enabled.
|
|
||||||
|
|
||||||
* New host keys will be hashed to and them unusable for malicious people or
|
|
||||||
software trying to use known_hosts to find further hops.
|
|
||||||
|
|
||||||
* Tunneled clear text passwords are disabled.
|
|
||||||
|
|
||||||
* PAM authentication is enabled.
|
|
||||||
|
|
||||||
* Only support for protocol 2 is enabled.
|
|
184
cavs_driver-ssh.pl
Normal file
184
cavs_driver-ssh.pl
Normal file
@ -0,0 +1,184 @@
|
|||||||
|
#!/usr/bin/env perl
|
||||||
|
#
|
||||||
|
# CAVS test driver for OpenSSH
|
||||||
|
#
|
||||||
|
# Copyright (C) 2015, Stephan Mueller <smueller@chronox.de>
|
||||||
|
#
|
||||||
|
# Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||||
|
# of this software and associated documentation files (the "Software"), to deal
|
||||||
|
# in the Software without restriction, including without limitation the rights
|
||||||
|
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||||
|
# copies of the Software, and to permit persons to whom the Software is
|
||||||
|
# furnished to do so, subject to the following conditions:
|
||||||
|
#
|
||||||
|
# The above copyright notice and this permission notice shall be included in
|
||||||
|
# all copies or substantial portions of the Software.
|
||||||
|
#
|
||||||
|
# NO WARRANTY
|
||||||
|
#
|
||||||
|
# BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
|
||||||
|
# FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
|
||||||
|
# OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
|
||||||
|
# PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
|
||||||
|
# OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
|
||||||
|
# MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
|
||||||
|
# TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
|
||||||
|
# PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
|
||||||
|
# REPAIR OR CORRECTION.
|
||||||
|
#
|
||||||
|
# IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
||||||
|
# WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
|
||||||
|
# REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
|
||||||
|
# INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
|
||||||
|
# OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
|
||||||
|
# TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
|
||||||
|
# YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
|
||||||
|
# PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
|
||||||
|
# POSSIBILITY OF SUCH DAMAGES.
|
||||||
|
#
|
||||||
|
use strict;
|
||||||
|
use warnings;
|
||||||
|
use IPC::Open2;
|
||||||
|
|
||||||
|
# Executing a program by feeding STDIN and retrieving
|
||||||
|
# STDOUT
|
||||||
|
# $1: data string to be piped to the app on STDIN
|
||||||
|
# rest: program and args
|
||||||
|
# returns: STDOUT of program as string
|
||||||
|
sub pipe_through_program($@) {
|
||||||
|
my $in = shift;
|
||||||
|
my @args = @_;
|
||||||
|
|
||||||
|
my ($CO, $CI);
|
||||||
|
my $pid = open2($CO, $CI, @args);
|
||||||
|
|
||||||
|
my $out = "";
|
||||||
|
my $len = length($in);
|
||||||
|
my $first = 1;
|
||||||
|
while (1) {
|
||||||
|
my $rin = "";
|
||||||
|
my $win = "";
|
||||||
|
# Output of prog is FD that we read
|
||||||
|
vec($rin,fileno($CO),1) = 1;
|
||||||
|
# Input of prog is FD that we write
|
||||||
|
# check for $first is needed because we can have NULL input
|
||||||
|
# that is to be written to the app
|
||||||
|
if ( $len > 0 || $first) {
|
||||||
|
(vec($win,fileno($CI),1) = 1);
|
||||||
|
$first=0;
|
||||||
|
}
|
||||||
|
# Let us wait for 100ms
|
||||||
|
my $nfound = select(my $rout=$rin, my $wout=$win, undef, 0.1);
|
||||||
|
if ( $wout ) {
|
||||||
|
my $written = syswrite($CI, $in, $len);
|
||||||
|
die "broken pipe" if !defined $written;
|
||||||
|
$len -= $written;
|
||||||
|
substr($in, 0, $written) = "";
|
||||||
|
if ($len <= 0) {
|
||||||
|
close $CI or die "broken pipe: $!";
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if ( $rout ) {
|
||||||
|
my $tmp_out = "";
|
||||||
|
my $bytes_read = sysread($CO, $tmp_out, 4096);
|
||||||
|
$out .= $tmp_out;
|
||||||
|
last if ($bytes_read == 0);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
close $CO or die "broken pipe: $!";
|
||||||
|
waitpid $pid, 0;
|
||||||
|
|
||||||
|
return $out;
|
||||||
|
}
|
||||||
|
|
||||||
|
# Parser of CAVS test vector file
|
||||||
|
# $1: Test vector file
|
||||||
|
# $2: Output file for test results
|
||||||
|
# return: nothing
|
||||||
|
sub parse($$) {
|
||||||
|
my $infile = shift;
|
||||||
|
my $outfile = shift;
|
||||||
|
|
||||||
|
my $out = "";
|
||||||
|
|
||||||
|
my $K = "";
|
||||||
|
my $H = "";
|
||||||
|
my $session_id = "";
|
||||||
|
my $ivlen = 0;
|
||||||
|
my $eklen = "";
|
||||||
|
my $iklen = "";
|
||||||
|
|
||||||
|
open(IN, "<$infile");
|
||||||
|
while(<IN>) {
|
||||||
|
|
||||||
|
my $line = $_;
|
||||||
|
chomp($line);
|
||||||
|
$line =~ s/\r//;
|
||||||
|
|
||||||
|
if ($line =~ /\[SHA-1\]/) {
|
||||||
|
$iklen = 20;
|
||||||
|
} elsif ($line =~ /\[SHA-256\]/) {
|
||||||
|
$iklen = 32;
|
||||||
|
} elsif ($line =~ /\[SHA-384\]/) {
|
||||||
|
$iklen = 48;
|
||||||
|
} elsif ($line =~ /\[SHA-512\]/) {
|
||||||
|
$iklen = 64;
|
||||||
|
} elsif ($line =~ /^\[IV length\s*=\s*(.*)\]/) {
|
||||||
|
$ivlen = $1;
|
||||||
|
$ivlen = $ivlen / 8;
|
||||||
|
} elsif ($line =~ /^\[encryption key length\s*=\s*(.*)\]/) {
|
||||||
|
$eklen = $1;
|
||||||
|
$eklen = $eklen / 8;
|
||||||
|
} elsif ($line =~ /^K\s*=\s*(.*)/) {
|
||||||
|
$K = $1;
|
||||||
|
$K = substr($K, 8);
|
||||||
|
$K = "00" . $K;
|
||||||
|
} elsif ($line =~ /^H\s*=\s*(.*)/) {
|
||||||
|
$H = $1;
|
||||||
|
} elsif ($line =~ /^session_id\s*=\s*(.*)/) {
|
||||||
|
$session_id = $1;
|
||||||
|
}
|
||||||
|
$out .= $line . "\n";
|
||||||
|
|
||||||
|
if ($K ne "" && $H ne "" && $session_id ne "" &&
|
||||||
|
$ivlen ne "" && $eklen ne "" && $iklen > 0) {
|
||||||
|
$out .= pipe_through_program("", "@LIBEXECDIR@/ssh/cavstest-kdf -H $H -K $K -s $session_id -i $ivlen -e $eklen -m $iklen");
|
||||||
|
|
||||||
|
$K = "";
|
||||||
|
$H = "";
|
||||||
|
$session_id = "";
|
||||||
|
}
|
||||||
|
}
|
||||||
|
close IN;
|
||||||
|
$out =~ s/\n/\r\n/g; # make it a dos file
|
||||||
|
open(OUT, ">$outfile") or die "Cannot create output file $outfile: $?";
|
||||||
|
print OUT $out;
|
||||||
|
close OUT;
|
||||||
|
}
|
||||||
|
|
||||||
|
############################################################
|
||||||
|
#
|
||||||
|
# let us pretend to be C :-)
|
||||||
|
sub main() {
|
||||||
|
|
||||||
|
my $infile=$ARGV[0];
|
||||||
|
die "Error: Test vector file $infile not found" if (! -f $infile);
|
||||||
|
|
||||||
|
my $outfile = $infile;
|
||||||
|
# let us add .rsp regardless whether we could strip .req
|
||||||
|
$outfile =~ s/\.req$//;
|
||||||
|
$outfile .= ".rsp";
|
||||||
|
if (-f $outfile) {
|
||||||
|
die "Output file $outfile could not be removed: $?"
|
||||||
|
unless unlink($outfile);
|
||||||
|
}
|
||||||
|
print STDERR "Performing tests from source file $infile with results stored in destination file $outfile\n";
|
||||||
|
|
||||||
|
# Do the job
|
||||||
|
parse($infile, $outfile);
|
||||||
|
}
|
||||||
|
|
||||||
|
###########################################
|
||||||
|
# Call it
|
||||||
|
main();
|
||||||
|
1;
|
@ -1,34 +0,0 @@
|
|||||||
# HG changeset patch
|
|
||||||
# Parent 1055b218140c3cc19228c47878a68740363d80dd
|
|
||||||
Do not throw away already open sockets for X11 forwarding if another socket
|
|
||||||
family is not available for bind()
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/channels.c b/openssh-6.6p1/channels.c
|
|
||||||
--- a/openssh-6.6p1/channels.c
|
|
||||||
+++ b/openssh-6.6p1/channels.c
|
|
||||||
@@ -3476,22 +3476,24 @@ x11_create_display_inet(int x11_display_
|
|
||||||
}
|
|
||||||
if (ai->ai_family == AF_INET6)
|
|
||||||
sock_set_v6only(sock);
|
|
||||||
if (x11_use_localhost)
|
|
||||||
channel_set_reuseaddr(sock);
|
|
||||||
if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
|
|
||||||
debug2("bind port %d: %.100s", port, strerror(errno));
|
|
||||||
close(sock);
|
|
||||||
-
|
|
||||||
+ continue;
|
|
||||||
+ /* do not remove successfully opened sockets
|
|
||||||
for (n = 0; n < num_socks; n++) {
|
|
||||||
close(socks[n]);
|
|
||||||
}
|
|
||||||
num_socks = 0;
|
|
||||||
break;
|
|
||||||
+ */
|
|
||||||
}
|
|
||||||
socks[num_socks++] = sock;
|
|
||||||
if (num_socks == NUM_SOCKS)
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
freeaddrinfo(aitop);
|
|
||||||
if (num_socks > 0)
|
|
||||||
break;
|
|
@ -1,33 +0,0 @@
|
|||||||
# Don't audit SSH_INVALID_USER twice.
|
|
||||||
# PRIVSEP(getpwnamallow()) a few lines above already did this.
|
|
||||||
#
|
|
||||||
# based on:
|
|
||||||
# https://bugzilla.mindrot.org/show_bug.cgi?id=1402
|
|
||||||
# https://bugzilla.mindrot.org/attachment.cgi?id=2010
|
|
||||||
# by jchadima@redhat.com
|
|
||||||
#
|
|
||||||
# PRIVSEP(getpwnamallow()) a few lines above already did this.
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/auth2.c b/openssh-6.6p1/auth2.c
|
|
||||||
--- a/openssh-6.6p1/auth2.c
|
|
||||||
+++ b/openssh-6.6p1/auth2.c
|
|
||||||
@@ -236,19 +236,16 @@ input_userauth_request(int type, u_int32
|
|
||||||
authctxt->pw = PRIVSEP(getpwnamallow(user));
|
|
||||||
authctxt->user = xstrdup(user);
|
|
||||||
if (authctxt->pw && strcmp(service, "ssh-connection")==0) {
|
|
||||||
authctxt->valid = 1;
|
|
||||||
debug2("input_userauth_request: setting up authctxt for %s", user);
|
|
||||||
} else {
|
|
||||||
logit("input_userauth_request: invalid user %s", user);
|
|
||||||
authctxt->pw = fakepw();
|
|
||||||
-#ifdef SSH_AUDIT_EVENTS
|
|
||||||
- PRIVSEP(audit_event(SSH_INVALID_USER));
|
|
||||||
-#endif
|
|
||||||
}
|
|
||||||
#ifdef USE_PAM
|
|
||||||
if (options.use_pam)
|
|
||||||
PRIVSEP(start_pam(authctxt));
|
|
||||||
#endif
|
|
||||||
setproctitle("%s%s", authctxt->valid ? user : "unknown",
|
|
||||||
use_privsep ? " [net]" : "");
|
|
||||||
authctxt->service = xstrdup(service);
|
|
@ -1,867 +0,0 @@
|
|||||||
# extended auditing of user actions
|
|
||||||
# based on:
|
|
||||||
# https://bugzilla.mindrot.org/show_bug.cgi?id=1402
|
|
||||||
# https://bugzilla.mindrot.org/attachment.cgi?id=2011
|
|
||||||
# by jchadima@redhat.com
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/audit-bsm.c b/openssh-6.6p1/audit-bsm.c
|
|
||||||
--- a/openssh-6.6p1/audit-bsm.c
|
|
||||||
+++ b/openssh-6.6p1/audit-bsm.c
|
|
||||||
@@ -370,20 +370,33 @@ audit_connection_from(const char *host,
|
|
||||||
/* this is used on IPv4-only machines */
|
|
||||||
tid->port = (dev_t)port;
|
|
||||||
tid->machine = inet_addr(host);
|
|
||||||
snprintf(buf, sizeof(buf), "%08x", tid->machine);
|
|
||||||
debug3("BSM audit: machine ID %s", buf);
|
|
||||||
#endif
|
|
||||||
}
|
|
||||||
|
|
||||||
-void
|
|
||||||
+int
|
|
||||||
audit_run_command(const char *command)
|
|
||||||
{
|
|
||||||
/* not implemented */
|
|
||||||
+ return 0;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+void
|
|
||||||
+audit_end_command(int handle, const char *command)
|
|
||||||
+{
|
|
||||||
+ /* not implemented */
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+void
|
|
||||||
+audit_count_session_open(void)
|
|
||||||
+{
|
|
||||||
+ /* not necessary */
|
|
||||||
}
|
|
||||||
|
|
||||||
void
|
|
||||||
audit_session_open(struct logininfo *li)
|
|
||||||
{
|
|
||||||
/* not implemented */
|
|
||||||
}
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/audit-linux.c b/openssh-6.6p1/audit-linux.c
|
|
||||||
--- a/openssh-6.6p1/audit-linux.c
|
|
||||||
+++ b/openssh-6.6p1/audit-linux.c
|
|
||||||
@@ -30,97 +30,210 @@
|
|
||||||
#include "includes.h"
|
|
||||||
#if defined(USE_LINUX_AUDIT)
|
|
||||||
#include <libaudit.h>
|
|
||||||
#include <unistd.h>
|
|
||||||
#include <string.h>
|
|
||||||
|
|
||||||
#include "log.h"
|
|
||||||
#include "audit.h"
|
|
||||||
+#include "key.h"
|
|
||||||
+#include "hostfile.h"
|
|
||||||
+#include "auth.h"
|
|
||||||
+#include "servconf.h"
|
|
||||||
#include "canohost.h"
|
|
||||||
|
|
||||||
+extern ServerOptions options;
|
|
||||||
+extern Authctxt *the_authctxt;
|
|
||||||
+extern u_int utmp_len;
|
|
||||||
const char* audit_username(void);
|
|
||||||
|
|
||||||
-int
|
|
||||||
-linux_audit_record_event(int uid, const char *username,
|
|
||||||
- const char *hostname, const char *ip, const char *ttyn, int success)
|
|
||||||
+static void
|
|
||||||
+linux_audit_user_logxxx(int uid, const char *username,
|
|
||||||
+ const char *hostname, const char *ip, const char *ttyn, int success, int event)
|
|
||||||
{
|
|
||||||
int audit_fd, rc, saved_errno;
|
|
||||||
|
|
||||||
audit_fd = audit_open();
|
|
||||||
if (audit_fd < 0) {
|
|
||||||
if (errno == EINVAL || errno == EPROTONOSUPPORT ||
|
|
||||||
errno == EAFNOSUPPORT)
|
|
||||||
- return 1; /* No audit support in kernel */
|
|
||||||
+ return; /* No audit support in kernel */
|
|
||||||
else
|
|
||||||
- return 0; /* Must prevent login */
|
|
||||||
+ goto fatal_report; /* Must prevent login */
|
|
||||||
}
|
|
||||||
- rc = audit_log_acct_message(audit_fd, AUDIT_USER_LOGIN,
|
|
||||||
+ rc = audit_log_acct_message(audit_fd, event,
|
|
||||||
NULL, "login", username ? username : "(unknown)",
|
|
||||||
username == NULL ? uid : -1, hostname, ip, ttyn, success);
|
|
||||||
saved_errno = errno;
|
|
||||||
close(audit_fd);
|
|
||||||
/*
|
|
||||||
* Do not report error if the error is EPERM and sshd is run as non
|
|
||||||
* root user.
|
|
||||||
*/
|
|
||||||
if ((rc == -EPERM) && (geteuid() != 0))
|
|
||||||
rc = 0;
|
|
||||||
errno = saved_errno;
|
|
||||||
- return (rc >= 0);
|
|
||||||
+ if (rc < 0) {
|
|
||||||
+fatal_report:
|
|
||||||
+ fatal("linux_audit_write_entry failed: %s", strerror(errno));
|
|
||||||
+ }
|
|
||||||
}
|
|
||||||
|
|
||||||
+static void
|
|
||||||
+linux_audit_user_auth(int uid, const char *username,
|
|
||||||
+ const char *hostname, const char *ip, const char *ttyn, int success, int event)
|
|
||||||
+{
|
|
||||||
+ int audit_fd, rc, saved_errno;
|
|
||||||
+ static const char *event_name[] = {
|
|
||||||
+ "maxtries exceeded",
|
|
||||||
+ "root denied",
|
|
||||||
+ "success",
|
|
||||||
+ "none",
|
|
||||||
+ "password",
|
|
||||||
+ "challenge-response",
|
|
||||||
+ "pubkey",
|
|
||||||
+ "hostbased",
|
|
||||||
+ "gssapi",
|
|
||||||
+ "invalid user",
|
|
||||||
+ "nologin",
|
|
||||||
+ "connection closed",
|
|
||||||
+ "connection abandoned",
|
|
||||||
+ "unknown"
|
|
||||||
+ };
|
|
||||||
+
|
|
||||||
+ audit_fd = audit_open();
|
|
||||||
+ if (audit_fd < 0) {
|
|
||||||
+ if (errno == EINVAL || errno == EPROTONOSUPPORT ||
|
|
||||||
+ errno == EAFNOSUPPORT)
|
|
||||||
+ return; /* No audit support in kernel */
|
|
||||||
+ else
|
|
||||||
+ goto fatal_report; /* Must prevent login */
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ if ((event < 0) || (event > SSH_AUDIT_UNKNOWN))
|
|
||||||
+ event = SSH_AUDIT_UNKNOWN;
|
|
||||||
+
|
|
||||||
+ rc = audit_log_acct_message(audit_fd, AUDIT_USER_AUTH,
|
|
||||||
+ NULL, event_name[event], username ? username : "(unknown)",
|
|
||||||
+ username == NULL ? uid : -1, hostname, ip, ttyn, success);
|
|
||||||
+ saved_errno = errno;
|
|
||||||
+ close(audit_fd);
|
|
||||||
+ /*
|
|
||||||
+ * Do not report error if the error is EPERM and sshd is run as non
|
|
||||||
+ * root user.
|
|
||||||
+ */
|
|
||||||
+ if ((rc == -EPERM) && (geteuid() != 0))
|
|
||||||
+ rc = 0;
|
|
||||||
+ errno = saved_errno;
|
|
||||||
+ if (rc < 0) {
|
|
||||||
+fatal_report:
|
|
||||||
+ fatal("linux_audit_write_entry failed: %s", strerror(errno));
|
|
||||||
+ }
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+static int user_login_count = 0;
|
|
||||||
+
|
|
||||||
/* Below is the sshd audit API code */
|
|
||||||
|
|
||||||
void
|
|
||||||
audit_connection_from(const char *host, int port)
|
|
||||||
{
|
|
||||||
+ /* not implemented */
|
|
||||||
}
|
|
||||||
- /* not implemented */
|
|
||||||
+
|
|
||||||
+int
|
|
||||||
+audit_run_command(const char *command)
|
|
||||||
+{
|
|
||||||
+ if (!user_login_count++)
|
|
||||||
+ linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns),
|
|
||||||
+ NULL, "ssh", 1, AUDIT_USER_LOGIN);
|
|
||||||
+ linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns),
|
|
||||||
+ NULL, "ssh", 1, AUDIT_USER_START);
|
|
||||||
+ return 0;
|
|
||||||
+}
|
|
||||||
|
|
||||||
void
|
|
||||||
-audit_run_command(const char *command)
|
|
||||||
+audit_end_command(int handle, const char *command)
|
|
||||||
{
|
|
||||||
- /* not implemented */
|
|
||||||
+ linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns),
|
|
||||||
+ NULL, "ssh", 1, AUDIT_USER_END);
|
|
||||||
+ if (user_login_count && !--user_login_count)
|
|
||||||
+ linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns),
|
|
||||||
+ NULL, "ssh", 1, AUDIT_USER_LOGOUT);
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+void
|
|
||||||
+audit_count_session_open(void)
|
|
||||||
+{
|
|
||||||
+ user_login_count++;
|
|
||||||
}
|
|
||||||
|
|
||||||
void
|
|
||||||
audit_session_open(struct logininfo *li)
|
|
||||||
{
|
|
||||||
- if (linux_audit_record_event(li->uid, NULL, li->hostname,
|
|
||||||
- NULL, li->line, 1) == 0)
|
|
||||||
- fatal("linux_audit_write_entry failed: %s", strerror(errno));
|
|
||||||
+ if (!user_login_count++)
|
|
||||||
+ linux_audit_user_logxxx(li->uid, NULL, li->hostname,
|
|
||||||
+ NULL, li->line, 1, AUDIT_USER_LOGIN);
|
|
||||||
+ linux_audit_user_logxxx(li->uid, NULL, li->hostname,
|
|
||||||
+ NULL, li->line, 1, AUDIT_USER_START);
|
|
||||||
}
|
|
||||||
|
|
||||||
void
|
|
||||||
audit_session_close(struct logininfo *li)
|
|
||||||
{
|
|
||||||
- /* not implemented */
|
|
||||||
+ linux_audit_user_logxxx(li->uid, NULL, li->hostname,
|
|
||||||
+ NULL, li->line, 1, AUDIT_USER_END);
|
|
||||||
+ if (user_login_count && !--user_login_count)
|
|
||||||
+ linux_audit_user_logxxx(li->uid, NULL, li->hostname,
|
|
||||||
+ NULL, li->line, 1, AUDIT_USER_LOGOUT);
|
|
||||||
}
|
|
||||||
|
|
||||||
void
|
|
||||||
audit_event(ssh_audit_event_t event)
|
|
||||||
{
|
|
||||||
switch(event) {
|
|
||||||
case SSH_AUTH_SUCCESS:
|
|
||||||
- case SSH_CONNECTION_CLOSE:
|
|
||||||
- case SSH_NOLOGIN:
|
|
||||||
- case SSH_LOGIN_EXCEED_MAXTRIES:
|
|
||||||
- case SSH_LOGIN_ROOT_DENIED:
|
|
||||||
+ linux_audit_user_auth(-1, audit_username(), NULL,
|
|
||||||
+ get_remote_ipaddr(), "ssh", 1, event);
|
|
||||||
break;
|
|
||||||
|
|
||||||
+ case SSH_NOLOGIN:
|
|
||||||
+ case SSH_LOGIN_ROOT_DENIED:
|
|
||||||
+ linux_audit_user_auth(-1, audit_username(), NULL,
|
|
||||||
+ get_remote_ipaddr(), "ssh", 0, event);
|
|
||||||
+ linux_audit_user_logxxx(-1, audit_username(), NULL,
|
|
||||||
+ get_remote_ipaddr(), "ssh", 0, AUDIT_USER_LOGIN);
|
|
||||||
+ break;
|
|
||||||
+
|
|
||||||
+ case SSH_LOGIN_EXCEED_MAXTRIES:
|
|
||||||
case SSH_AUTH_FAIL_NONE:
|
|
||||||
case SSH_AUTH_FAIL_PASSWD:
|
|
||||||
case SSH_AUTH_FAIL_KBDINT:
|
|
||||||
case SSH_AUTH_FAIL_PUBKEY:
|
|
||||||
case SSH_AUTH_FAIL_HOSTBASED:
|
|
||||||
case SSH_AUTH_FAIL_GSSAPI:
|
|
||||||
+ linux_audit_user_auth(-1, audit_username(), NULL,
|
|
||||||
+ get_remote_ipaddr(), "ssh", 0, event);
|
|
||||||
+ break;
|
|
||||||
+
|
|
||||||
+ case SSH_CONNECTION_CLOSE:
|
|
||||||
+ if (user_login_count) {
|
|
||||||
+ while (user_login_count--)
|
|
||||||
+ linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns),
|
|
||||||
+ NULL, "ssh", 1, AUDIT_USER_END);
|
|
||||||
+ linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns),
|
|
||||||
+ NULL, "ssh", 1, AUDIT_USER_LOGOUT);
|
|
||||||
+ }
|
|
||||||
+ break;
|
|
||||||
+
|
|
||||||
+ case SSH_CONNECTION_ABANDON:
|
|
||||||
case SSH_INVALID_USER:
|
|
||||||
- linux_audit_record_event(-1, audit_username(), NULL,
|
|
||||||
- get_remote_ipaddr(), "sshd", 0);
|
|
||||||
+ linux_audit_user_logxxx(-1, audit_username(), NULL,
|
|
||||||
+ get_remote_ipaddr(), "ssh", 0, AUDIT_USER_LOGIN);
|
|
||||||
break;
|
|
||||||
|
|
||||||
default:
|
|
||||||
debug("%s: unhandled event %d", __func__, event);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif /* USE_LINUX_AUDIT */
|
|
||||||
diff --git a/openssh-6.6p1/audit.c b/openssh-6.6p1/audit.c
|
|
||||||
--- a/openssh-6.6p1/audit.c
|
|
||||||
+++ b/openssh-6.6p1/audit.c
|
|
||||||
@@ -135,16 +135,27 @@ audit_connection_from(const char *host,
|
|
||||||
void
|
|
||||||
audit_event(ssh_audit_event_t event)
|
|
||||||
{
|
|
||||||
debug("audit event euid %d user %s event %d (%s)", geteuid(),
|
|
||||||
audit_username(), event, audit_event_lookup(event));
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
+ * Called when a child process has called, or will soon call,
|
|
||||||
+ * audit_session_open.
|
|
||||||
+ */
|
|
||||||
+void
|
|
||||||
+audit_count_session_open(void)
|
|
||||||
+{
|
|
||||||
+ debug("audit count session open euid %d user %s", geteuid(),
|
|
||||||
+ audit_username());
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+/*
|
|
||||||
* Called when a user session is started. Argument is the tty allocated to
|
|
||||||
* the session, or NULL if no tty was allocated.
|
|
||||||
*
|
|
||||||
* Note that this may be called multiple times if multiple sessions are used
|
|
||||||
* within a single connection.
|
|
||||||
*/
|
|
||||||
void
|
|
||||||
audit_session_open(struct logininfo *li)
|
|
||||||
@@ -169,18 +180,34 @@ audit_session_close(struct logininfo *li
|
|
||||||
|
|
||||||
debug("audit session close euid %d user %s tty name %s", geteuid(),
|
|
||||||
audit_username(), t);
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
* This will be called when a user runs a non-interactive command. Note that
|
|
||||||
* it may be called multiple times for a single connection since SSH2 allows
|
|
||||||
- * multiple sessions within a single connection.
|
|
||||||
+ * multiple sessions within a single connection. Returns a "handle" for
|
|
||||||
+ * audit_end_command.
|
|
||||||
*/
|
|
||||||
-void
|
|
||||||
+int
|
|
||||||
audit_run_command(const char *command)
|
|
||||||
{
|
|
||||||
debug("audit run command euid %d user %s command '%.200s'", geteuid(),
|
|
||||||
audit_username(), command);
|
|
||||||
+ return 0;
|
|
||||||
}
|
|
||||||
+
|
|
||||||
+/*
|
|
||||||
+ * This will be called when the non-interactive command finishes. Note that
|
|
||||||
+ * it may be called multiple times for a single connection since SSH2 allows
|
|
||||||
+ * multiple sessions within a single connection. "handle" should come from
|
|
||||||
+ * the corresponding audit_run_command.
|
|
||||||
+ */
|
|
||||||
+void
|
|
||||||
+audit_end_command(int handle, const char *command)
|
|
||||||
+{
|
|
||||||
+ debug("audit end nopty exec euid %d user %s command '%.200s'", geteuid(),
|
|
||||||
+ audit_username(), command);
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
# endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */
|
|
||||||
#endif /* SSH_AUDIT_EVENTS */
|
|
||||||
diff --git a/openssh-6.6p1/audit.h b/openssh-6.6p1/audit.h
|
|
||||||
--- a/openssh-6.6p1/audit.h
|
|
||||||
+++ b/openssh-6.6p1/audit.h
|
|
||||||
@@ -44,14 +44,16 @@ enum ssh_audit_event_type {
|
|
||||||
SSH_CONNECTION_CLOSE, /* closed after attempting auth or session */
|
|
||||||
SSH_CONNECTION_ABANDON, /* closed without completing auth */
|
|
||||||
SSH_AUDIT_UNKNOWN
|
|
||||||
};
|
|
||||||
typedef enum ssh_audit_event_type ssh_audit_event_t;
|
|
||||||
|
|
||||||
void audit_connection_from(const char *, int);
|
|
||||||
void audit_event(ssh_audit_event_t);
|
|
||||||
+void audit_count_session_open(void);
|
|
||||||
void audit_session_open(struct logininfo *);
|
|
||||||
void audit_session_close(struct logininfo *);
|
|
||||||
-void audit_run_command(const char *);
|
|
||||||
+int audit_run_command(const char *);
|
|
||||||
+void audit_end_command(int, const char *);
|
|
||||||
ssh_audit_event_t audit_classify_auth(const char *);
|
|
||||||
|
|
||||||
#endif /* _SSH_AUDIT_H */
|
|
||||||
diff --git a/openssh-6.6p1/monitor.c b/openssh-6.6p1/monitor.c
|
|
||||||
--- a/openssh-6.6p1/monitor.c
|
|
||||||
+++ b/openssh-6.6p1/monitor.c
|
|
||||||
@@ -175,16 +175,17 @@ int mm_answer_gss_setup_ctx(int, Buffer
|
|
||||||
int mm_answer_gss_accept_ctx(int, Buffer *);
|
|
||||||
int mm_answer_gss_userok(int, Buffer *);
|
|
||||||
int mm_answer_gss_checkmic(int, Buffer *);
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#ifdef SSH_AUDIT_EVENTS
|
|
||||||
int mm_answer_audit_event(int, Buffer *);
|
|
||||||
int mm_answer_audit_command(int, Buffer *);
|
|
||||||
+int mm_answer_audit_end_command(int, Buffer *);
|
|
||||||
#endif
|
|
||||||
|
|
||||||
static int monitor_read_log(struct monitor *);
|
|
||||||
|
|
||||||
static Authctxt *authctxt;
|
|
||||||
static BIGNUM *ssh1_challenge = NULL; /* used for ssh1 rsa auth */
|
|
||||||
|
|
||||||
/* local state for key verify */
|
|
||||||
@@ -255,16 +256,17 @@ struct mon_table mon_dispatch_postauth20
|
|
||||||
{MONITOR_REQ_MODULI, 0, mm_answer_moduli},
|
|
||||||
{MONITOR_REQ_SIGN, 0, mm_answer_sign},
|
|
||||||
{MONITOR_REQ_PTY, 0, mm_answer_pty},
|
|
||||||
{MONITOR_REQ_PTYCLEANUP, 0, mm_answer_pty_cleanup},
|
|
||||||
{MONITOR_REQ_TERM, 0, mm_answer_term},
|
|
||||||
#ifdef SSH_AUDIT_EVENTS
|
|
||||||
{MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
|
|
||||||
{MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT, mm_answer_audit_command},
|
|
||||||
+ {MONITOR_REQ_AUDIT_END_COMMAND, MON_PERMIT, mm_answer_audit_end_command},
|
|
||||||
#endif
|
|
||||||
{0, 0, NULL}
|
|
||||||
};
|
|
||||||
|
|
||||||
struct mon_table mon_dispatch_proto15[] = {
|
|
||||||
{MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow},
|
|
||||||
{MONITOR_REQ_SESSKEY, MON_ONCE, mm_answer_sesskey},
|
|
||||||
{MONITOR_REQ_SESSID, MON_ONCE, mm_answer_sessid},
|
|
||||||
@@ -297,16 +299,17 @@ struct mon_table mon_dispatch_proto15[]
|
|
||||||
|
|
||||||
struct mon_table mon_dispatch_postauth15[] = {
|
|
||||||
{MONITOR_REQ_PTY, MON_ONCE, mm_answer_pty},
|
|
||||||
{MONITOR_REQ_PTYCLEANUP, MON_ONCE, mm_answer_pty_cleanup},
|
|
||||||
{MONITOR_REQ_TERM, 0, mm_answer_term},
|
|
||||||
#ifdef SSH_AUDIT_EVENTS
|
|
||||||
{MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
|
|
||||||
{MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT|MON_ONCE, mm_answer_audit_command},
|
|
||||||
+ {MONITOR_REQ_AUDIT_END_COMMAND, MON_PERMIT, mm_answer_audit_end_command},
|
|
||||||
#endif
|
|
||||||
{0, 0, NULL}
|
|
||||||
};
|
|
||||||
|
|
||||||
struct mon_table *mon_dispatch;
|
|
||||||
|
|
||||||
/* Specifies if a certain message is allowed at the moment */
|
|
||||||
|
|
||||||
@@ -1420,16 +1423,22 @@ mm_record_login(Session *s, struct passw
|
|
||||||
static void
|
|
||||||
mm_session_close(Session *s)
|
|
||||||
{
|
|
||||||
debug3("%s: session %d pid %ld", __func__, s->self, (long)s->pid);
|
|
||||||
if (s->ttyfd != -1) {
|
|
||||||
debug3("%s: tty %s ptyfd %d", __func__, s->tty, s->ptyfd);
|
|
||||||
session_pty_cleanup2(s);
|
|
||||||
}
|
|
||||||
+#ifdef SSH_AUDIT_EVENTS
|
|
||||||
+ if (s->command != NULL) {
|
|
||||||
+ debug3("%s: command %d", __func__, s->command_handle);
|
|
||||||
+ session_end_command2(s);
|
|
||||||
+ }
|
|
||||||
+#endif
|
|
||||||
session_unused(s->self);
|
|
||||||
}
|
|
||||||
|
|
||||||
int
|
|
||||||
mm_answer_pty(int sock, Buffer *m)
|
|
||||||
{
|
|
||||||
extern struct monitor *pmonitor;
|
|
||||||
Session *s;
|
|
||||||
@@ -1742,21 +1751,53 @@ mm_answer_audit_event(int socket, Buffer
|
|
||||||
return (0);
|
|
||||||
}
|
|
||||||
|
|
||||||
int
|
|
||||||
mm_answer_audit_command(int socket, Buffer *m)
|
|
||||||
{
|
|
||||||
u_int len;
|
|
||||||
char *cmd;
|
|
||||||
+ Session *s;
|
|
||||||
|
|
||||||
debug3("%s entering", __func__);
|
|
||||||
cmd = buffer_get_string(m, &len);
|
|
||||||
/* sanity check command, if so how? */
|
|
||||||
- audit_run_command(cmd);
|
|
||||||
+ s = session_new();
|
|
||||||
+ if (s == NULL)
|
|
||||||
+ fatal("%s: error allocating a session", __func__);
|
|
||||||
+ s->command = cmd;
|
|
||||||
+ s->command_handle = audit_run_command(cmd);
|
|
||||||
+
|
|
||||||
+ buffer_clear(m);
|
|
||||||
+ buffer_put_int(m, s->self);
|
|
||||||
+
|
|
||||||
+ mm_request_send(socket, MONITOR_ANS_AUDIT_COMMAND, m);
|
|
||||||
+
|
|
||||||
+ return (0);
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+int
|
|
||||||
+mm_answer_audit_end_command(int socket, Buffer *m)
|
|
||||||
+{
|
|
||||||
+ int handle;
|
|
||||||
+ u_int len;
|
|
||||||
+ char *cmd;
|
|
||||||
+ Session *s;
|
|
||||||
+
|
|
||||||
+ debug3("%s entering", __func__);
|
|
||||||
+ handle = buffer_get_int(m);
|
|
||||||
+ cmd = buffer_get_string(m, &len);
|
|
||||||
+
|
|
||||||
+ s = session_by_id(handle);
|
|
||||||
+ if (s == NULL || s->ttyfd != -1 || s->command == NULL ||
|
|
||||||
+ strcmp(s->command, cmd) != 0)
|
|
||||||
+ fatal("%s: invalid handle", __func__);
|
|
||||||
+ mm_session_close(s);
|
|
||||||
+
|
|
||||||
free(cmd);
|
|
||||||
return (0);
|
|
||||||
}
|
|
||||||
#endif /* SSH_AUDIT_EVENTS */
|
|
||||||
|
|
||||||
void
|
|
||||||
monitor_apply_keystate(struct monitor *pmonitor)
|
|
||||||
{
|
|
||||||
diff --git a/openssh-6.6p1/monitor.h b/openssh-6.6p1/monitor.h
|
|
||||||
--- a/openssh-6.6p1/monitor.h
|
|
||||||
+++ b/openssh-6.6p1/monitor.h
|
|
||||||
@@ -59,16 +59,17 @@ enum monitor_reqtype {
|
|
||||||
|
|
||||||
MONITOR_REQ_PAM_START = 100,
|
|
||||||
MONITOR_REQ_PAM_ACCOUNT = 102, MONITOR_ANS_PAM_ACCOUNT = 103,
|
|
||||||
MONITOR_REQ_PAM_INIT_CTX = 104, MONITOR_ANS_PAM_INIT_CTX = 105,
|
|
||||||
MONITOR_REQ_PAM_QUERY = 106, MONITOR_ANS_PAM_QUERY = 107,
|
|
||||||
MONITOR_REQ_PAM_RESPOND = 108, MONITOR_ANS_PAM_RESPOND = 109,
|
|
||||||
MONITOR_REQ_PAM_FREE_CTX = 110, MONITOR_ANS_PAM_FREE_CTX = 111,
|
|
||||||
MONITOR_REQ_AUDIT_EVENT = 112, MONITOR_REQ_AUDIT_COMMAND = 113,
|
|
||||||
+ MONITOR_ANS_AUDIT_COMMAND = 114, MONITOR_REQ_AUDIT_END_COMMAND = 115,
|
|
||||||
|
|
||||||
};
|
|
||||||
|
|
||||||
struct mm_master;
|
|
||||||
struct monitor {
|
|
||||||
int m_recvfd;
|
|
||||||
int m_sendfd;
|
|
||||||
int m_log_recvfd;
|
|
||||||
diff --git a/openssh-6.6p1/monitor_wrap.c b/openssh-6.6p1/monitor_wrap.c
|
|
||||||
--- a/openssh-6.6p1/monitor_wrap.c
|
|
||||||
+++ b/openssh-6.6p1/monitor_wrap.c
|
|
||||||
@@ -1184,27 +1184,48 @@ mm_audit_event(ssh_audit_event_t event)
|
|
||||||
|
|
||||||
buffer_init(&m);
|
|
||||||
buffer_put_int(&m, event);
|
|
||||||
|
|
||||||
mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_EVENT, &m);
|
|
||||||
buffer_free(&m);
|
|
||||||
}
|
|
||||||
|
|
||||||
-void
|
|
||||||
+int
|
|
||||||
mm_audit_run_command(const char *command)
|
|
||||||
{
|
|
||||||
Buffer m;
|
|
||||||
+ int handle;
|
|
||||||
|
|
||||||
debug3("%s entering command %s", __func__, command);
|
|
||||||
|
|
||||||
buffer_init(&m);
|
|
||||||
buffer_put_cstring(&m, command);
|
|
||||||
|
|
||||||
mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_COMMAND, &m);
|
|
||||||
+ mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_AUDIT_COMMAND, &m);
|
|
||||||
+
|
|
||||||
+ handle = buffer_get_int(&m);
|
|
||||||
+ buffer_free(&m);
|
|
||||||
+
|
|
||||||
+ return (handle);
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+void
|
|
||||||
+mm_audit_end_command(int handle, const char *command)
|
|
||||||
+{
|
|
||||||
+ Buffer m;
|
|
||||||
+
|
|
||||||
+ debug3("%s entering command %s", __func__, command);
|
|
||||||
+
|
|
||||||
+ buffer_init(&m);
|
|
||||||
+ buffer_put_int(&m, handle);
|
|
||||||
+ buffer_put_cstring(&m, command);
|
|
||||||
+
|
|
||||||
+ mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_END_COMMAND, &m);
|
|
||||||
buffer_free(&m);
|
|
||||||
}
|
|
||||||
#endif /* SSH_AUDIT_EVENTS */
|
|
||||||
|
|
||||||
#ifdef GSSAPI
|
|
||||||
OM_uint32
|
|
||||||
mm_ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID goid)
|
|
||||||
{
|
|
||||||
diff --git a/openssh-6.6p1/monitor_wrap.h b/openssh-6.6p1/monitor_wrap.h
|
|
||||||
--- a/openssh-6.6p1/monitor_wrap.h
|
|
||||||
+++ b/openssh-6.6p1/monitor_wrap.h
|
|
||||||
@@ -69,17 +69,18 @@ void *mm_sshpam_init_ctx(struct Authctxt
|
|
||||||
int mm_sshpam_query(void *, char **, char **, u_int *, char ***, u_int **);
|
|
||||||
int mm_sshpam_respond(void *, u_int, char **);
|
|
||||||
void mm_sshpam_free_ctx(void *);
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#ifdef SSH_AUDIT_EVENTS
|
|
||||||
#include "audit.h"
|
|
||||||
void mm_audit_event(ssh_audit_event_t);
|
|
||||||
-void mm_audit_run_command(const char *);
|
|
||||||
+int mm_audit_run_command(const char *);
|
|
||||||
+void mm_audit_end_command(int, const char *);
|
|
||||||
#endif
|
|
||||||
|
|
||||||
struct Session;
|
|
||||||
void mm_terminate(void);
|
|
||||||
int mm_pty_allocate(int *, int *, char *, size_t);
|
|
||||||
void mm_session_pty_cleanup2(struct Session *);
|
|
||||||
|
|
||||||
/* SSHv1 interfaces */
|
|
||||||
diff --git a/openssh-6.6p1/session.c b/openssh-6.6p1/session.c
|
|
||||||
--- a/openssh-6.6p1/session.c
|
|
||||||
+++ b/openssh-6.6p1/session.c
|
|
||||||
@@ -740,16 +740,24 @@ do_exec_pty(Session *s, const char *comm
|
|
||||||
cygwin_set_impersonation_token(INVALID_HANDLE_VALUE);
|
|
||||||
#endif
|
|
||||||
|
|
||||||
s->pid = pid;
|
|
||||||
|
|
||||||
/* Parent. Close the slave side of the pseudo tty. */
|
|
||||||
close(ttyfd);
|
|
||||||
|
|
||||||
+#ifndef HAVE_OSF_SIA
|
|
||||||
+ /* do_login in the child did not affect state in this process,
|
|
||||||
+ compensate. From an architectural standpoint, this is extremely
|
|
||||||
+ ugly. */
|
|
||||||
+ if (!(options.use_login && command == NULL))
|
|
||||||
+ audit_count_session_open();
|
|
||||||
+#endif
|
|
||||||
+
|
|
||||||
/* Enter interactive session. */
|
|
||||||
s->ptymaster = ptymaster;
|
|
||||||
packet_set_interactive(1,
|
|
||||||
options.ip_qos_interactive, options.ip_qos_bulk);
|
|
||||||
if (compat20) {
|
|
||||||
session_set_fds(s, ptyfd, fdout, -1, 1, 1);
|
|
||||||
} else {
|
|
||||||
server_loop(pid, ptyfd, fdout, -1);
|
|
||||||
@@ -834,25 +842,29 @@ do_exec(Session *s, const char *command)
|
|
||||||
session_type,
|
|
||||||
tty == NULL ? "" : " on ",
|
|
||||||
tty == NULL ? "" : tty,
|
|
||||||
s->pw->pw_name,
|
|
||||||
get_remote_ipaddr(),
|
|
||||||
get_remote_port());
|
|
||||||
|
|
||||||
#ifdef SSH_AUDIT_EVENTS
|
|
||||||
+ if (s->command != NULL || s->command_handle != -1)
|
|
||||||
+ fatal("do_exec: command already set");
|
|
||||||
if (command != NULL)
|
|
||||||
- PRIVSEP(audit_run_command(command));
|
|
||||||
+ s->command = xstrdup(command);
|
|
||||||
else if (s->ttyfd == -1) {
|
|
||||||
char *shell = s->pw->pw_shell;
|
|
||||||
|
|
||||||
if (shell[0] == '\0') /* empty shell means /bin/sh */
|
|
||||||
shell =_PATH_BSHELL;
|
|
||||||
- PRIVSEP(audit_run_command(shell));
|
|
||||||
+ s->command = xstrdup(shell);
|
|
||||||
}
|
|
||||||
+ if (s->command != NULL)
|
|
||||||
+ s->command_handle = PRIVSEP(audit_run_command(s->command));
|
|
||||||
#endif
|
|
||||||
if (s->ttyfd != -1)
|
|
||||||
ret = do_exec_pty(s, command);
|
|
||||||
else
|
|
||||||
ret = do_exec_no_pty(s, command);
|
|
||||||
|
|
||||||
original_command = NULL;
|
|
||||||
|
|
||||||
@@ -1908,16 +1920,17 @@ session_unused(int id)
|
|
||||||
memset(&sessions[id], 0, sizeof(*sessions));
|
|
||||||
sessions[id].self = id;
|
|
||||||
sessions[id].used = 0;
|
|
||||||
sessions[id].chanid = -1;
|
|
||||||
sessions[id].ptyfd = -1;
|
|
||||||
sessions[id].ttyfd = -1;
|
|
||||||
sessions[id].ptymaster = -1;
|
|
||||||
sessions[id].x11_chanids = NULL;
|
|
||||||
+ sessions[id].command_handle = -1;
|
|
||||||
sessions[id].next_unused = sessions_first_unused;
|
|
||||||
sessions_first_unused = id;
|
|
||||||
}
|
|
||||||
|
|
||||||
Session *
|
|
||||||
session_new(void)
|
|
||||||
{
|
|
||||||
Session *s, *tmp;
|
|
||||||
@@ -1990,16 +2003,29 @@ session_open(Authctxt *authctxt, int cha
|
|
||||||
if (s->pw == NULL || !authctxt->valid)
|
|
||||||
fatal("no user for session %d", s->self);
|
|
||||||
debug("session_open: session %d: link with channel %d", s->self, chanid);
|
|
||||||
s->chanid = chanid;
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
Session *
|
|
||||||
+session_by_id(int id)
|
|
||||||
+{
|
|
||||||
+ if (id >= 0 && id < sessions_nalloc) {
|
|
||||||
+ Session *s = &sessions[id];
|
|
||||||
+ if (s->used)
|
|
||||||
+ return s;
|
|
||||||
+ }
|
|
||||||
+ debug("session_by_id: unknown id %d", id);
|
|
||||||
+ session_dump();
|
|
||||||
+ return NULL;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+Session *
|
|
||||||
session_by_tty(char *tty)
|
|
||||||
{
|
|
||||||
int i;
|
|
||||||
for (i = 0; i < sessions_nalloc; i++) {
|
|
||||||
Session *s = &sessions[i];
|
|
||||||
if (s->used && s->ttyfd != -1 && strcmp(s->tty, tty) == 0) {
|
|
||||||
debug("session_by_tty: session %d tty %s", i, tty);
|
|
||||||
return s;
|
|
||||||
@@ -2506,16 +2532,40 @@ session_exit_message(Session *s, int sta
|
|
||||||
* interested in data we write.
|
|
||||||
* Note that we must not call 'chan_read_failed', since there could
|
|
||||||
* be some more data waiting in the pipe.
|
|
||||||
*/
|
|
||||||
if (c->ostate != CHAN_OUTPUT_CLOSED)
|
|
||||||
chan_write_failed(c);
|
|
||||||
}
|
|
||||||
|
|
||||||
+#ifdef SSH_AUDIT_EVENTS
|
|
||||||
+void
|
|
||||||
+session_end_command2(Session *s)
|
|
||||||
+{
|
|
||||||
+ if (s->command != NULL) {
|
|
||||||
+ audit_end_command(s->command_handle, s->command);
|
|
||||||
+ free(s->command);
|
|
||||||
+ s->command = NULL;
|
|
||||||
+ s->command_handle = -1;
|
|
||||||
+ }
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+static void
|
|
||||||
+session_end_command(Session *s)
|
|
||||||
+{
|
|
||||||
+ if (s->command != NULL) {
|
|
||||||
+ PRIVSEP(audit_end_command(s->command_handle, s->command));
|
|
||||||
+ free(s->command);
|
|
||||||
+ s->command = NULL;
|
|
||||||
+ s->command_handle = -1;
|
|
||||||
+ }
|
|
||||||
+}
|
|
||||||
+#endif
|
|
||||||
+
|
|
||||||
void
|
|
||||||
session_close(Session *s)
|
|
||||||
{
|
|
||||||
u_int i;
|
|
||||||
int do_xauth;
|
|
||||||
|
|
||||||
debug("session_close: session %d pid %ld", s->self, (long)s->pid);
|
|
||||||
|
|
||||||
@@ -2546,16 +2596,20 @@ session_close(Session *s)
|
|
||||||
int status;
|
|
||||||
|
|
||||||
waitpid(pid, &status, 0);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if (s->ttyfd != -1)
|
|
||||||
session_pty_cleanup(s);
|
|
||||||
+#ifdef SSH_AUDIT_EVENTS
|
|
||||||
+ if (s->command)
|
|
||||||
+ session_end_command(s);
|
|
||||||
+#endif
|
|
||||||
free(s->term);
|
|
||||||
free(s->display);
|
|
||||||
free(s->x11_chanids);
|
|
||||||
free(s->auth_display);
|
|
||||||
free(s->auth_data);
|
|
||||||
free(s->auth_proto);
|
|
||||||
free(s->subsys);
|
|
||||||
if (s->env != NULL) {
|
|
||||||
@@ -2760,16 +2814,25 @@ session_setup_x11fwd(Session *s)
|
|
||||||
}
|
|
||||||
|
|
||||||
static void
|
|
||||||
do_authenticated2(Authctxt *authctxt)
|
|
||||||
{
|
|
||||||
server_loop2(authctxt);
|
|
||||||
}
|
|
||||||
|
|
||||||
+static void
|
|
||||||
+do_cleanup_one_session(Session *s)
|
|
||||||
+{
|
|
||||||
+ session_pty_cleanup2(s);
|
|
||||||
+#ifdef SSH_AUDIT_EVENTS
|
|
||||||
+ session_end_command2(s);
|
|
||||||
+#endif
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
void
|
|
||||||
do_cleanup(Authctxt *authctxt)
|
|
||||||
{
|
|
||||||
static int called = 0;
|
|
||||||
|
|
||||||
debug("do_cleanup");
|
|
||||||
|
|
||||||
/* no cleanup if we're in the child for login shell */
|
|
||||||
@@ -2808,10 +2871,10 @@ do_cleanup(Authctxt *authctxt)
|
|
||||||
/* remove agent socket */
|
|
||||||
auth_sock_cleanup_proc(authctxt->pw);
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Cleanup ptys/utmp only if privsep is disabled,
|
|
||||||
* or if running in monitor.
|
|
||||||
*/
|
|
||||||
if (!use_privsep || mm_is_monitor())
|
|
||||||
- session_destroy_all(session_pty_cleanup2);
|
|
||||||
+ session_destroy_all(do_cleanup_one_session);
|
|
||||||
}
|
|
||||||
diff --git a/openssh-6.6p1/session.h b/openssh-6.6p1/session.h
|
|
||||||
--- a/openssh-6.6p1/session.h
|
|
||||||
+++ b/openssh-6.6p1/session.h
|
|
||||||
@@ -56,29 +56,37 @@ struct Session {
|
|
||||||
int *x11_chanids;
|
|
||||||
int is_subsystem;
|
|
||||||
char *subsys;
|
|
||||||
u_int num_env;
|
|
||||||
struct {
|
|
||||||
char *name;
|
|
||||||
char *val;
|
|
||||||
} *env;
|
|
||||||
+
|
|
||||||
+ /* exec */
|
|
||||||
+#ifdef SSH_AUDIT_EVENTS
|
|
||||||
+ int command_handle;
|
|
||||||
+ char *command;
|
|
||||||
+#endif
|
|
||||||
};
|
|
||||||
|
|
||||||
void do_authenticated(Authctxt *);
|
|
||||||
void do_cleanup(Authctxt *);
|
|
||||||
|
|
||||||
int session_open(Authctxt *, int);
|
|
||||||
void session_unused(int);
|
|
||||||
int session_input_channel_req(Channel *, const char *);
|
|
||||||
void session_close_by_pid(pid_t, int);
|
|
||||||
void session_close_by_channel(int, void *);
|
|
||||||
void session_destroy_all(void (*)(Session *));
|
|
||||||
void session_pty_cleanup2(Session *);
|
|
||||||
+void session_end_command2(Session *);
|
|
||||||
|
|
||||||
Session *session_new(void);
|
|
||||||
+Session *session_by_id(int);
|
|
||||||
Session *session_by_tty(char *);
|
|
||||||
void session_close(Session *);
|
|
||||||
void do_setusercontext(struct passwd *);
|
|
||||||
void child_set_env(char ***envp, u_int *envsizep, const char *name,
|
|
||||||
const char *value);
|
|
||||||
|
|
||||||
#endif
|
|
||||||
diff --git a/openssh-6.6p1/sshd.c b/openssh-6.6p1/sshd.c
|
|
||||||
--- a/openssh-6.6p1/sshd.c
|
|
||||||
+++ b/openssh-6.6p1/sshd.c
|
|
||||||
@@ -2532,13 +2532,14 @@ cleanup_exit(int i)
|
|
||||||
if (kill(pmonitor->m_pid, SIGKILL) != 0 &&
|
|
||||||
errno != ESRCH)
|
|
||||||
error("%s: kill(%d): %s", __func__,
|
|
||||||
pmonitor->m_pid, strerror(errno));
|
|
||||||
}
|
|
||||||
}
|
|
||||||
#ifdef SSH_AUDIT_EVENTS
|
|
||||||
/* done after do_cleanup so it can cancel the PAM auth 'thread' */
|
|
||||||
- if (!use_privsep || mm_is_monitor())
|
|
||||||
+ if ((the_authctxt == NULL || !the_authctxt->authenticated) &&
|
|
||||||
+ (!use_privsep || mm_is_monitor()))
|
|
||||||
audit_event(SSH_CONNECTION_ABANDON);
|
|
||||||
#endif
|
|
||||||
_exit(i);
|
|
||||||
}
|
|
@ -1,61 +0,0 @@
|
|||||||
# HG changeset patch
|
|
||||||
# Parent 5482d21e8bd06309af51dea77a5f3668859fb2a0
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/auth-rsa.c b/openssh-6.6p1/auth-rsa.c
|
|
||||||
--- a/openssh-6.6p1/auth-rsa.c
|
|
||||||
+++ b/openssh-6.6p1/auth-rsa.c
|
|
||||||
@@ -94,16 +94,20 @@ int
|
|
||||||
auth_rsa_verify_response(Key *key, BIGNUM *challenge,
|
|
||||||
u_char response[SSH_DIGEST_MAX_LENGTH])
|
|
||||||
{
|
|
||||||
u_char buf[2 * SSH_DIGEST_MAX_LENGTH], mdbuf[SSH_DIGEST_MAX_LENGTH];
|
|
||||||
struct ssh_digest_ctx *md;
|
|
||||||
int len;
|
|
||||||
int dgst;
|
|
||||||
size_t dgst_len;
|
|
||||||
+ int rv;
|
|
||||||
+#ifdef SSH_AUDIT_EVENTS
|
|
||||||
+ char *fp;
|
|
||||||
+#endif
|
|
||||||
|
|
||||||
/* don't allow short keys */
|
|
||||||
if (BN_num_bits(key->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE) {
|
|
||||||
error("%s: RSA modulus too small: %d < minimum %d bits",
|
|
||||||
__func__,
|
|
||||||
BN_num_bits(key->rsa->n), SSH_RSA_MINIMUM_MODULUS_SIZE);
|
|
||||||
return (0);
|
|
||||||
}
|
|
||||||
@@ -121,22 +125,28 @@ auth_rsa_verify_response(Key *key, BIGNU
|
|
||||||
if ((md = ssh_digest_start(dgst)) == NULL ||
|
|
||||||
ssh_digest_update(md, buf, 2 * dgst_len) < 0 ||
|
|
||||||
ssh_digest_update(md, session_id, dgst_len) < 0 ||
|
|
||||||
ssh_digest_final(md, mdbuf, sizeof(mdbuf)) < 0)
|
|
||||||
fatal("%s: md5 failed", __func__);
|
|
||||||
ssh_digest_free(md);
|
|
||||||
|
|
||||||
/* Verify that the response is the original challenge. */
|
|
||||||
- if (timingsafe_bcmp(response, mdbuf, dgst_len) != 0) {
|
|
||||||
- /* Wrong answer. */
|
|
||||||
- return (0);
|
|
||||||
+ rv = timingsafe_bcmp(response, mdbuf, dgst_len) == 0;
|
|
||||||
+
|
|
||||||
+#ifdef SSH_AUDIT_EVENTS
|
|
||||||
+ fp = key_fingerprint(key, key_fp_type_select(), SSH_FP_HEX);
|
|
||||||
+ if (audit_keyusage(1, "ssh-rsa1", RSA_size(key->rsa) * 8, fp, rv) == 0) {
|
|
||||||
+ debug("unsuccessful audit");
|
|
||||||
+ rv = 0;
|
|
||||||
}
|
|
||||||
- /* Correct answer. */
|
|
||||||
- return (1);
|
|
||||||
+ free(fp);
|
|
||||||
+#endif
|
|
||||||
+
|
|
||||||
+ return rv;
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Performs the RSA authentication challenge-response dialog with the client,
|
|
||||||
* and returns true (non-zero) if the client gave the correct answer to
|
|
||||||
* our challenge; returns zero if the client gives a wrong answer.
|
|
||||||
*/
|
|
||||||
|
|
@ -1,506 +0,0 @@
|
|||||||
# auditing key-based authentication (both server and client)
|
|
||||||
# based on:
|
|
||||||
# https://bugzilla.mindrot.org/show_bug.cgi?id=1402
|
|
||||||
# https://bugzilla.mindrot.org/attachment.cgi?id=2012
|
|
||||||
# (replaces: https://bugzilla.mindrot.org/attachment.cgi?id=1975)
|
|
||||||
# by jchadima@redhat.com
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/audit-bsm.c b/openssh-6.6p1/audit-bsm.c
|
|
||||||
--- a/openssh-6.6p1/audit-bsm.c
|
|
||||||
+++ b/openssh-6.6p1/audit-bsm.c
|
|
||||||
@@ -401,16 +401,22 @@ audit_session_open(struct logininfo *li)
|
|
||||||
}
|
|
||||||
|
|
||||||
void
|
|
||||||
audit_session_close(struct logininfo *li)
|
|
||||||
{
|
|
||||||
/* not implemented */
|
|
||||||
}
|
|
||||||
|
|
||||||
+int
|
|
||||||
+audit_keyusage(int host_user, const char *type, unsigned bits, char *fp, int rv)
|
|
||||||
+{
|
|
||||||
+ /* not implemented */
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
void
|
|
||||||
audit_event(ssh_audit_event_t event)
|
|
||||||
{
|
|
||||||
char textbuf[BSM_TEXTBUFSZ];
|
|
||||||
static int logged_in = 0;
|
|
||||||
const char *user = the_authctxt ? the_authctxt->user : "(unknown user)";
|
|
||||||
|
|
||||||
if (cannot_audit(0))
|
|
||||||
diff --git a/openssh-6.6p1/audit-linux.c b/openssh-6.6p1/audit-linux.c
|
|
||||||
--- a/openssh-6.6p1/audit-linux.c
|
|
||||||
+++ b/openssh-6.6p1/audit-linux.c
|
|
||||||
@@ -36,16 +36,18 @@
|
|
||||||
#include "log.h"
|
|
||||||
#include "audit.h"
|
|
||||||
#include "key.h"
|
|
||||||
#include "hostfile.h"
|
|
||||||
#include "auth.h"
|
|
||||||
#include "servconf.h"
|
|
||||||
#include "canohost.h"
|
|
||||||
|
|
||||||
+#define AUDIT_LOG_SIZE 128
|
|
||||||
+
|
|
||||||
extern ServerOptions options;
|
|
||||||
extern Authctxt *the_authctxt;
|
|
||||||
extern u_int utmp_len;
|
|
||||||
const char* audit_username(void);
|
|
||||||
|
|
||||||
static void
|
|
||||||
linux_audit_user_logxxx(int uid, const char *username,
|
|
||||||
const char *hostname, const char *ip, const char *ttyn, int success, int event)
|
|
||||||
@@ -125,16 +127,47 @@ linux_audit_user_auth(int uid, const cha
|
|
||||||
rc = 0;
|
|
||||||
errno = saved_errno;
|
|
||||||
if (rc < 0) {
|
|
||||||
fatal_report:
|
|
||||||
fatal("linux_audit_write_entry failed: %s", strerror(errno));
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
+int
|
|
||||||
+audit_keyusage(int host_user, const char *type, unsigned bits, char *fp, int rv)
|
|
||||||
+{
|
|
||||||
+ char buf[AUDIT_LOG_SIZE];
|
|
||||||
+ int audit_fd, rc, saved_errno;
|
|
||||||
+
|
|
||||||
+ audit_fd = audit_open();
|
|
||||||
+ if (audit_fd < 0) {
|
|
||||||
+ if (errno == EINVAL || errno == EPROTONOSUPPORT ||
|
|
||||||
+ errno == EAFNOSUPPORT)
|
|
||||||
+ return 1; /* No audit support in kernel */
|
|
||||||
+ else
|
|
||||||
+ return 0; /* Must prevent login */
|
|
||||||
+ }
|
|
||||||
+ snprintf(buf, sizeof(buf), "%s_auth rport=%d", host_user ? "pubkey" : "hostbased", get_remote_port());
|
|
||||||
+ rc = audit_log_acct_message(audit_fd, AUDIT_USER_AUTH, NULL,
|
|
||||||
+ buf, audit_username(), -1, NULL, get_remote_ipaddr(), NULL, rv);
|
|
||||||
+ if ((rc < 0) && ((rc != -1) || (getuid() == 0)))
|
|
||||||
+ goto out;
|
|
||||||
+ snprintf(buf, sizeof(buf), "key algo=%s size=%d fp=%s rport=%d",
|
|
||||||
+ type, bits, fp, get_remote_port());
|
|
||||||
+ rc = audit_log_acct_message(audit_fd, AUDIT_USER_AUTH, NULL,
|
|
||||||
+ buf, audit_username(), -1, NULL, get_remote_ipaddr(), NULL, rv);
|
|
||||||
+out:
|
|
||||||
+ saved_errno = errno;
|
|
||||||
+ audit_close(audit_fd);
|
|
||||||
+ errno = saved_errno;
|
|
||||||
+ /* do not report error if the error is EPERM and sshd is run as non root user */
|
|
||||||
+ return (rc >= 0) || ((rc == -EPERM) && (getuid() != 0));
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
static int user_login_count = 0;
|
|
||||||
|
|
||||||
/* Below is the sshd audit API code */
|
|
||||||
|
|
||||||
void
|
|
||||||
audit_connection_from(const char *host, int port)
|
|
||||||
{
|
|
||||||
/* not implemented */
|
|
||||||
diff --git a/openssh-6.6p1/audit.c b/openssh-6.6p1/audit.c
|
|
||||||
--- a/openssh-6.6p1/audit.c
|
|
||||||
+++ b/openssh-6.6p1/audit.c
|
|
||||||
@@ -31,16 +31,17 @@
|
|
||||||
|
|
||||||
#ifdef SSH_AUDIT_EVENTS
|
|
||||||
|
|
||||||
#include "audit.h"
|
|
||||||
#include "log.h"
|
|
||||||
#include "key.h"
|
|
||||||
#include "hostfile.h"
|
|
||||||
#include "auth.h"
|
|
||||||
+#include "xmalloc.h"
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Care must be taken when using this since it WILL NOT be initialized when
|
|
||||||
* audit_connection_from() is called and MAY NOT be initialized when
|
|
||||||
* audit_event(CONNECTION_ABANDON) is called. Test for NULL before using.
|
|
||||||
*/
|
|
||||||
extern Authctxt *the_authctxt;
|
|
||||||
|
|
||||||
@@ -106,16 +107,32 @@ audit_event_lookup(ssh_audit_event_t ev)
|
|
||||||
};
|
|
||||||
|
|
||||||
for (i = 0; event_lookup[i].event != SSH_AUDIT_UNKNOWN; i++)
|
|
||||||
if (event_lookup[i].event == ev)
|
|
||||||
break;
|
|
||||||
return(event_lookup[i].name);
|
|
||||||
}
|
|
||||||
|
|
||||||
+void
|
|
||||||
+audit_key(int host_user, int *rv, const Key *key)
|
|
||||||
+{
|
|
||||||
+ char *fp;
|
|
||||||
+ const char *crypto_name;
|
|
||||||
+
|
|
||||||
+ fp = key_fingerprint(key, key_fp_type_select(), SSH_FP_HEX);
|
|
||||||
+ if (key->type == KEY_RSA1)
|
|
||||||
+ crypto_name = "ssh-rsa1";
|
|
||||||
+ else
|
|
||||||
+ crypto_name = key_ssh_name(key);
|
|
||||||
+ if (audit_keyusage(host_user, crypto_name, key_size(key), fp, *rv) == 0)
|
|
||||||
+ *rv = 0;
|
|
||||||
+ free(fp);
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
# ifndef CUSTOM_SSH_AUDIT_EVENTS
|
|
||||||
/*
|
|
||||||
* Null implementations of audit functions.
|
|
||||||
* These get used if SSH_AUDIT_EVENTS is defined but no audit module is enabled.
|
|
||||||
*/
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Called after a connection has been accepted but before any authentication
|
|
||||||
@@ -204,10 +221,22 @@ audit_run_command(const char *command)
|
|
||||||
*/
|
|
||||||
void
|
|
||||||
audit_end_command(int handle, const char *command)
|
|
||||||
{
|
|
||||||
debug("audit end nopty exec euid %d user %s command '%.200s'", geteuid(),
|
|
||||||
audit_username(), command);
|
|
||||||
}
|
|
||||||
|
|
||||||
+/*
|
|
||||||
+ * This will be called when user is successfully autherized by the RSA1/RSA/DSA key.
|
|
||||||
+ *
|
|
||||||
+ * Type is the key type, len is the key length(byte) and fp is the fingerprint of the key.
|
|
||||||
+ */
|
|
||||||
+int
|
|
||||||
+audit_keyusage(int host_user, const char *type, unsigned bits, char *fp, int rv)
|
|
||||||
+{
|
|
||||||
+ debug("audit %s key usage euid %d user %s key type %s key length %d fingerprint %s, result %d",
|
|
||||||
+ host_user ? "pubkey" : "hostbased", geteuid(), audit_username(), type, bits,
|
|
||||||
+ fp, rv);
|
|
||||||
+}
|
|
||||||
# endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */
|
|
||||||
#endif /* SSH_AUDIT_EVENTS */
|
|
||||||
diff --git a/openssh-6.6p1/audit.h b/openssh-6.6p1/audit.h
|
|
||||||
--- a/openssh-6.6p1/audit.h
|
|
||||||
+++ b/openssh-6.6p1/audit.h
|
|
||||||
@@ -23,16 +23,17 @@
|
|
||||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
|
||||||
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
||||||
*/
|
|
||||||
|
|
||||||
#ifndef _SSH_AUDIT_H
|
|
||||||
# define _SSH_AUDIT_H
|
|
||||||
|
|
||||||
#include "loginrec.h"
|
|
||||||
+#include "key.h"
|
|
||||||
|
|
||||||
enum ssh_audit_event_type {
|
|
||||||
SSH_LOGIN_EXCEED_MAXTRIES,
|
|
||||||
SSH_LOGIN_ROOT_DENIED,
|
|
||||||
SSH_AUTH_SUCCESS,
|
|
||||||
SSH_AUTH_FAIL_NONE,
|
|
||||||
SSH_AUTH_FAIL_PASSWD,
|
|
||||||
SSH_AUTH_FAIL_KBDINT, /* keyboard-interactive or challenge-response */
|
|
||||||
@@ -50,10 +51,12 @@ typedef enum ssh_audit_event_type ssh_au
|
|
||||||
void audit_connection_from(const char *, int);
|
|
||||||
void audit_event(ssh_audit_event_t);
|
|
||||||
void audit_count_session_open(void);
|
|
||||||
void audit_session_open(struct logininfo *);
|
|
||||||
void audit_session_close(struct logininfo *);
|
|
||||||
int audit_run_command(const char *);
|
|
||||||
void audit_end_command(int, const char *);
|
|
||||||
ssh_audit_event_t audit_classify_auth(const char *);
|
|
||||||
+int audit_keyusage(int, const char *, unsigned, char *, int);
|
|
||||||
+void audit_key(int, int *, const Key *);
|
|
||||||
|
|
||||||
#endif /* _SSH_AUDIT_H */
|
|
||||||
diff --git a/openssh-6.6p1/auth.h b/openssh-6.6p1/auth.h
|
|
||||||
--- a/openssh-6.6p1/auth.h
|
|
||||||
+++ b/openssh-6.6p1/auth.h
|
|
||||||
@@ -178,16 +178,17 @@ int allowed_user(struct passwd *);
|
|
||||||
struct passwd * getpwnamallow(const char *user);
|
|
||||||
|
|
||||||
char *get_challenge(Authctxt *);
|
|
||||||
int verify_response(Authctxt *, const char *);
|
|
||||||
void abandon_challenge_response(Authctxt *);
|
|
||||||
|
|
||||||
char *expand_authorized_keys(const char *, struct passwd *pw);
|
|
||||||
char *authorized_principals_file(struct passwd *);
|
|
||||||
+int user_key_verify(const Key *, const u_char *, u_int, const u_char *, u_int);
|
|
||||||
|
|
||||||
FILE *auth_openkeyfile(const char *, struct passwd *, int);
|
|
||||||
FILE *auth_openprincipals(const char *, struct passwd *, int);
|
|
||||||
int auth_key_is_revoked(Key *);
|
|
||||||
|
|
||||||
HostStatus
|
|
||||||
check_key_in_hostfiles(struct passwd *, Key *, const char *,
|
|
||||||
const char *, const char *);
|
|
||||||
@@ -195,16 +196,17 @@ check_key_in_hostfiles(struct passwd *,
|
|
||||||
/* hostkey handling */
|
|
||||||
Key *get_hostkey_by_index(int);
|
|
||||||
Key *get_hostkey_public_by_index(int);
|
|
||||||
Key *get_hostkey_public_by_type(int);
|
|
||||||
Key *get_hostkey_private_by_type(int);
|
|
||||||
int get_hostkey_index(Key *);
|
|
||||||
int ssh1_session_key(BIGNUM *);
|
|
||||||
void sshd_hostkey_sign(Key *, Key *, u_char **, u_int *, u_char *, u_int);
|
|
||||||
+int hostbased_key_verify(const Key *, const u_char *, u_int, const u_char *, u_int);
|
|
||||||
|
|
||||||
/* debug messages during authentication */
|
|
||||||
void auth_debug_add(const char *fmt,...) __attribute__((format(printf, 1, 2)));
|
|
||||||
void auth_debug_send(void);
|
|
||||||
void auth_debug_reset(void);
|
|
||||||
|
|
||||||
struct passwd *fakepw(void);
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/auth2-hostbased.c b/openssh-6.6p1/auth2-hostbased.c
|
|
||||||
--- a/openssh-6.6p1/auth2-hostbased.c
|
|
||||||
+++ b/openssh-6.6p1/auth2-hostbased.c
|
|
||||||
@@ -124,33 +124,45 @@ userauth_hostbased(Authctxt *authctxt)
|
|
||||||
#endif
|
|
||||||
|
|
||||||
pubkey_auth_info(authctxt, key,
|
|
||||||
"client user \"%.100s\", client host \"%.100s\"", cuser, chost);
|
|
||||||
|
|
||||||
/* test for allowed key and correct signature */
|
|
||||||
authenticated = 0;
|
|
||||||
if (PRIVSEP(hostbased_key_allowed(authctxt->pw, cuser, chost, key)) &&
|
|
||||||
- PRIVSEP(key_verify(key, sig, slen, buffer_ptr(&b),
|
|
||||||
+ PRIVSEP(hostbased_key_verify(key, sig, slen, buffer_ptr(&b),
|
|
||||||
buffer_len(&b))) == 1)
|
|
||||||
authenticated = 1;
|
|
||||||
|
|
||||||
buffer_free(&b);
|
|
||||||
done:
|
|
||||||
debug2("userauth_hostbased: authenticated %d", authenticated);
|
|
||||||
if (key != NULL)
|
|
||||||
key_free(key);
|
|
||||||
free(pkalg);
|
|
||||||
free(pkblob);
|
|
||||||
free(cuser);
|
|
||||||
free(chost);
|
|
||||||
free(sig);
|
|
||||||
return authenticated;
|
|
||||||
}
|
|
||||||
|
|
||||||
+int
|
|
||||||
+hostbased_key_verify(const Key *key, const u_char *sig, u_int slen, const u_char *data, u_int datalen)
|
|
||||||
+{
|
|
||||||
+ int rv;
|
|
||||||
+
|
|
||||||
+ rv = key_verify(key, sig, slen, data, datalen);
|
|
||||||
+#ifdef SSH_AUDIT_EVENTS
|
|
||||||
+ audit_key(0, &rv, key);
|
|
||||||
+#endif
|
|
||||||
+ return rv;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
/* return 1 if given hostkey is allowed */
|
|
||||||
int
|
|
||||||
hostbased_key_allowed(struct passwd *pw, const char *cuser, char *chost,
|
|
||||||
Key *key)
|
|
||||||
{
|
|
||||||
const char *resolvedname, *ipaddr, *lookup, *reason;
|
|
||||||
HostStatus host_status;
|
|
||||||
int len;
|
|
||||||
diff --git a/openssh-6.6p1/auth2-pubkey.c b/openssh-6.6p1/auth2-pubkey.c
|
|
||||||
--- a/openssh-6.6p1/auth2-pubkey.c
|
|
||||||
+++ b/openssh-6.6p1/auth2-pubkey.c
|
|
||||||
@@ -153,17 +153,17 @@ userauth_pubkey(Authctxt *authctxt)
|
|
||||||
#ifdef DEBUG_PK
|
|
||||||
buffer_dump(&b);
|
|
||||||
#endif
|
|
||||||
pubkey_auth_info(authctxt, key, NULL);
|
|
||||||
|
|
||||||
/* test for correct signature */
|
|
||||||
authenticated = 0;
|
|
||||||
if (PRIVSEP(user_key_allowed(authctxt->pw, key)) &&
|
|
||||||
- PRIVSEP(key_verify(key, sig, slen, buffer_ptr(&b),
|
|
||||||
+ PRIVSEP(user_key_verify(key, sig, slen, buffer_ptr(&b),
|
|
||||||
buffer_len(&b))) == 1)
|
|
||||||
authenticated = 1;
|
|
||||||
buffer_free(&b);
|
|
||||||
free(sig);
|
|
||||||
} else {
|
|
||||||
debug("test whether pkalg/pkblob are acceptable");
|
|
||||||
packet_check_eom();
|
|
||||||
|
|
||||||
@@ -190,16 +190,28 @@ done:
|
|
||||||
debug2("userauth_pubkey: authenticated %d pkalg %s", authenticated, pkalg);
|
|
||||||
if (key != NULL)
|
|
||||||
key_free(key);
|
|
||||||
free(pkalg);
|
|
||||||
free(pkblob);
|
|
||||||
return authenticated;
|
|
||||||
}
|
|
||||||
|
|
||||||
+int
|
|
||||||
+user_key_verify(const Key *key, const u_char *sig, u_int slen, const u_char *data, u_int datalen)
|
|
||||||
+{
|
|
||||||
+ int rv;
|
|
||||||
+
|
|
||||||
+ rv = key_verify(key, sig, slen, data, datalen);
|
|
||||||
+#ifdef SSH_AUDIT_EVENTS
|
|
||||||
+ audit_key(1, &rv, key);
|
|
||||||
+#endif
|
|
||||||
+ return rv;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
void
|
|
||||||
pubkey_auth_info(Authctxt *authctxt, const Key *key, const char *fmt, ...)
|
|
||||||
{
|
|
||||||
char *fp, *extra;
|
|
||||||
va_list ap;
|
|
||||||
int i;
|
|
||||||
|
|
||||||
extra = NULL;
|
|
||||||
diff --git a/openssh-6.6p1/monitor.c b/openssh-6.6p1/monitor.c
|
|
||||||
--- a/openssh-6.6p1/monitor.c
|
|
||||||
+++ b/openssh-6.6p1/monitor.c
|
|
||||||
@@ -1340,26 +1340,30 @@ monitor_valid_hostbasedblob(u_char *data
|
|
||||||
}
|
|
||||||
|
|
||||||
int
|
|
||||||
mm_answer_keyverify(int sock, Buffer *m)
|
|
||||||
{
|
|
||||||
Key *key;
|
|
||||||
u_char *signature, *data, *blob;
|
|
||||||
u_int signaturelen, datalen, bloblen;
|
|
||||||
+ int type = 0;
|
|
||||||
int verified = 0;
|
|
||||||
int valid_data = 0;
|
|
||||||
|
|
||||||
+ type = buffer_get_int(m);
|
|
||||||
blob = buffer_get_string(m, &bloblen);
|
|
||||||
signature = buffer_get_string(m, &signaturelen);
|
|
||||||
data = buffer_get_string(m, &datalen);
|
|
||||||
|
|
||||||
if (hostbased_cuser == NULL || hostbased_chost == NULL ||
|
|
||||||
!monitor_allowed_key(blob, bloblen))
|
|
||||||
fatal("%s: bad key, not previously allowed", __func__);
|
|
||||||
+ if (type != key_blobtype)
|
|
||||||
+ fatal("%s: bad key type", __func__);
|
|
||||||
|
|
||||||
key = key_from_blob(blob, bloblen);
|
|
||||||
if (key == NULL)
|
|
||||||
fatal("%s: bad public key blob", __func__);
|
|
||||||
|
|
||||||
switch (key_blobtype) {
|
|
||||||
case MM_USERKEY:
|
|
||||||
valid_data = monitor_valid_userblob(data, datalen);
|
|
||||||
@@ -1370,17 +1374,27 @@ mm_answer_keyverify(int sock, Buffer *m)
|
|
||||||
break;
|
|
||||||
default:
|
|
||||||
valid_data = 0;
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
if (!valid_data)
|
|
||||||
fatal("%s: bad signature data blob", __func__);
|
|
||||||
|
|
||||||
- verified = key_verify(key, signature, signaturelen, data, datalen);
|
|
||||||
+ switch (key_blobtype) {
|
|
||||||
+ case MM_USERKEY:
|
|
||||||
+ verified = user_key_verify(key, signature, signaturelen, data, datalen);
|
|
||||||
+ break;
|
|
||||||
+ case MM_HOSTKEY:
|
|
||||||
+ verified = hostbased_key_verify(key, signature, signaturelen, data, datalen);
|
|
||||||
+ break;
|
|
||||||
+ default:
|
|
||||||
+ verified = 0;
|
|
||||||
+ break;
|
|
||||||
+ }
|
|
||||||
debug3("%s: key %p signature %s",
|
|
||||||
__func__, key, (verified == 1) ? "verified" : "unverified");
|
|
||||||
|
|
||||||
key_free(key);
|
|
||||||
free(blob);
|
|
||||||
free(signature);
|
|
||||||
free(data);
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/monitor_wrap.c b/openssh-6.6p1/monitor_wrap.c
|
|
||||||
--- a/openssh-6.6p1/monitor_wrap.c
|
|
||||||
+++ b/openssh-6.6p1/monitor_wrap.c
|
|
||||||
@@ -426,30 +426,31 @@ mm_key_allowed(enum mm_keytype type, cha
|
|
||||||
|
|
||||||
/*
|
|
||||||
* This key verify needs to send the key type along, because the
|
|
||||||
* privileged parent makes the decision if the key is allowed
|
|
||||||
* for authentication.
|
|
||||||
*/
|
|
||||||
|
|
||||||
int
|
|
||||||
-mm_key_verify(Key *key, u_char *sig, u_int siglen, u_char *data, u_int datalen)
|
|
||||||
+mm_key_verify(enum mm_keytype type, Key *key, u_char *sig, u_int siglen, u_char *data, u_int datalen)
|
|
||||||
{
|
|
||||||
Buffer m;
|
|
||||||
u_char *blob;
|
|
||||||
u_int len;
|
|
||||||
int verified = 0;
|
|
||||||
|
|
||||||
debug3("%s entering", __func__);
|
|
||||||
|
|
||||||
/* Convert the key to a blob and the pass it over */
|
|
||||||
if (!key_to_blob(key, &blob, &len))
|
|
||||||
return (0);
|
|
||||||
|
|
||||||
buffer_init(&m);
|
|
||||||
+ buffer_put_int(&m, type);
|
|
||||||
buffer_put_string(&m, blob, len);
|
|
||||||
buffer_put_string(&m, sig, siglen);
|
|
||||||
buffer_put_string(&m, data, datalen);
|
|
||||||
free(blob);
|
|
||||||
|
|
||||||
mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_KEYVERIFY, &m);
|
|
||||||
|
|
||||||
debug3("%s: waiting for MONITOR_ANS_KEYVERIFY", __func__);
|
|
||||||
@@ -457,16 +458,29 @@ mm_key_verify(Key *key, u_char *sig, u_i
|
|
||||||
|
|
||||||
verified = buffer_get_int(&m);
|
|
||||||
|
|
||||||
buffer_free(&m);
|
|
||||||
|
|
||||||
return (verified);
|
|
||||||
}
|
|
||||||
|
|
||||||
+int
|
|
||||||
+mm_hostbased_key_verify(Key *key, u_char *sig, u_int siglen, u_char *data, u_int datalen)
|
|
||||||
+{
|
|
||||||
+ return mm_key_verify(MM_HOSTKEY, key, sig, siglen, data, datalen);
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+int
|
|
||||||
+mm_user_key_verify(Key *key, u_char *sig, u_int siglen, u_char *data, u_int datalen)
|
|
||||||
+{
|
|
||||||
+ return mm_key_verify(MM_USERKEY, key, sig, siglen, data, datalen);
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+
|
|
||||||
/* Export key state after authentication */
|
|
||||||
Newkeys *
|
|
||||||
mm_newkeys_from_blob(u_char *blob, int blen)
|
|
||||||
{
|
|
||||||
Buffer b;
|
|
||||||
u_int len;
|
|
||||||
Newkeys *newkey = NULL;
|
|
||||||
Enc *enc;
|
|
||||||
diff --git a/openssh-6.6p1/monitor_wrap.h b/openssh-6.6p1/monitor_wrap.h
|
|
||||||
--- a/openssh-6.6p1/monitor_wrap.h
|
|
||||||
+++ b/openssh-6.6p1/monitor_wrap.h
|
|
||||||
@@ -44,17 +44,18 @@ int mm_key_sign(Key *, u_char **, u_int
|
|
||||||
void mm_inform_authserv(char *, char *);
|
|
||||||
struct passwd *mm_getpwnamallow(const char *);
|
|
||||||
char *mm_auth2_read_banner(void);
|
|
||||||
int mm_auth_password(struct Authctxt *, char *);
|
|
||||||
int mm_key_allowed(enum mm_keytype, char *, char *, Key *);
|
|
||||||
int mm_user_key_allowed(struct passwd *, Key *);
|
|
||||||
int mm_hostbased_key_allowed(struct passwd *, char *, char *, Key *);
|
|
||||||
int mm_auth_rhosts_rsa_key_allowed(struct passwd *, char *, char *, Key *);
|
|
||||||
-int mm_key_verify(Key *, u_char *, u_int, u_char *, u_int);
|
|
||||||
+int mm_hostbased_key_verify(Key *, u_char *, u_int, u_char *, u_int);
|
|
||||||
+int mm_user_key_verify(Key *, u_char *, u_int, u_char *, u_int);
|
|
||||||
int mm_auth_rsa_key_allowed(struct passwd *, BIGNUM *, Key **);
|
|
||||||
int mm_auth_rsa_verify_response(Key *, BIGNUM *, u_char *);
|
|
||||||
BIGNUM *mm_auth_rsa_generate_challenge(Key *);
|
|
||||||
|
|
||||||
#ifdef GSSAPI
|
|
||||||
OM_uint32 mm_ssh_gssapi_server_ctx(Gssctxt **, gss_OID);
|
|
||||||
OM_uint32 mm_ssh_gssapi_accept_ctx(Gssctxt *,
|
|
||||||
gss_buffer_desc *, gss_buffer_desc *, OM_uint32 *);
|
|
@ -1,82 +0,0 @@
|
|||||||
# HG changeset patch
|
|
||||||
# Parent 274a545b591567f1378c1086ad3ba40c911a8bd6
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/Makefile.in b/openssh-6.6p1/Makefile.in
|
|
||||||
--- a/openssh-6.6p1/Makefile.in
|
|
||||||
+++ b/openssh-6.6p1/Makefile.in
|
|
||||||
@@ -72,17 +72,18 @@ LIBSSH_OBJS=authfd.o authfile.o bufaux.o
|
|
||||||
atomicio.o key.o dispatch.o kex.o mac.o uidswap.o uuencode.o misc.o \
|
|
||||||
monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-rsa.o dh.o \
|
|
||||||
kexdh.o kexgex.o kexdhc.o kexgexc.o bufec.o kexecdh.o kexecdhc.o \
|
|
||||||
msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \
|
|
||||||
ssh-pkcs11.o krl.o smult_curve25519_ref.o \
|
|
||||||
kexc25519.o kexc25519c.o poly1305.o chacha.o cipher-chachapoly.o \
|
|
||||||
ssh-ed25519.o digest-openssl.o hmac.o \
|
|
||||||
sc25519.o ge25519.o fe25519.o ed25519.o verify.o hash.o blocks.o \
|
|
||||||
- fips.o
|
|
||||||
+ fips.o \
|
|
||||||
+ auditstub.o
|
|
||||||
|
|
||||||
SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
|
|
||||||
sshconnect.o sshconnect1.o sshconnect2.o mux.o \
|
|
||||||
roaming_common.o roaming_client.o
|
|
||||||
|
|
||||||
SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o \
|
|
||||||
audit.o audit-bsm.o audit-linux.o platform.o \
|
|
||||||
sshpty.o sshlogin.o servconf.o serverloop.o \
|
|
||||||
diff --git a/openssh-6.6p1/cipher.c b/openssh-6.6p1/cipher.c
|
|
||||||
--- a/openssh-6.6p1/cipher.c
|
|
||||||
+++ b/openssh-6.6p1/cipher.c
|
|
||||||
@@ -54,30 +54,16 @@
|
|
||||||
|
|
||||||
/* compatibility with old or broken OpenSSL versions */
|
|
||||||
#include "openbsd-compat/openssl-compat.h"
|
|
||||||
|
|
||||||
extern const EVP_CIPHER *evp_ssh1_bf(void);
|
|
||||||
extern const EVP_CIPHER *evp_ssh1_3des(void);
|
|
||||||
extern void ssh1_3des_iv(EVP_CIPHER_CTX *, int, u_char *, int);
|
|
||||||
|
|
||||||
-struct Cipher {
|
|
||||||
- char *name;
|
|
||||||
- int number; /* for ssh1 only */
|
|
||||||
- u_int block_size;
|
|
||||||
- u_int key_len;
|
|
||||||
- u_int iv_len; /* defaults to block_size */
|
|
||||||
- u_int auth_len;
|
|
||||||
- u_int discard_len;
|
|
||||||
- u_int flags;
|
|
||||||
-#define CFLAG_CBC (1<<0)
|
|
||||||
-#define CFLAG_CHACHAPOLY (1<<1)
|
|
||||||
- const EVP_CIPHER *(*evptype)(void);
|
|
||||||
-};
|
|
||||||
-
|
|
||||||
static const struct Cipher ciphers_all[] = {
|
|
||||||
{ "none", SSH_CIPHER_NONE, 8, 0, 0, 0, 0, 0, EVP_enc_null },
|
|
||||||
{ "des", SSH_CIPHER_DES, 8, 8, 0, 0, 0, 1, EVP_des_cbc },
|
|
||||||
{ "3des", SSH_CIPHER_3DES, 8, 16, 0, 0, 0, 1, evp_ssh1_3des },
|
|
||||||
{ "blowfish", SSH_CIPHER_BLOWFISH, 8, 32, 0, 0, 0, 1, evp_ssh1_bf },
|
|
||||||
|
|
||||||
{ "3des-cbc", SSH_CIPHER_SSH2, 8, 24, 0, 0, 0, 1, EVP_des_ede3_cbc },
|
|
||||||
{ "blowfish-cbc",
|
|
||||||
diff --git a/openssh-6.6p1/sshd.c b/openssh-6.6p1/sshd.c
|
|
||||||
--- a/openssh-6.6p1/sshd.c
|
|
||||||
+++ b/openssh-6.6p1/sshd.c
|
|
||||||
@@ -119,16 +119,18 @@
|
|
||||||
#endif
|
|
||||||
#include "monitor_wrap.h"
|
|
||||||
#include "roaming.h"
|
|
||||||
#include "ssh-sandbox.h"
|
|
||||||
#include "version.h"
|
|
||||||
|
|
||||||
#include "fips.h"
|
|
||||||
|
|
||||||
+#include "audit.h"
|
|
||||||
+
|
|
||||||
#ifdef LIBWRAP
|
|
||||||
#include <tcpd.h>
|
|
||||||
#include <syslog.h>
|
|
||||||
int allow_severity;
|
|
||||||
int deny_severity;
|
|
||||||
#endif /* LIBWRAP */
|
|
||||||
|
|
||||||
#ifndef O_NOCTTY
|
|
@ -1,701 +0,0 @@
|
|||||||
# key exhange auditing
|
|
||||||
# based on:
|
|
||||||
# https://bugzilla.mindrot.org/show_bug.cgi?id=1402
|
|
||||||
# https://bugzilla.mindrot.org/attachment.cgi?id=2013
|
|
||||||
# (replaces: https://bugzilla.mindrot.org/attachment.cgi?id=1976)
|
|
||||||
# by jchadima@redhat.com
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/audit-bsm.c b/openssh-6.6p1/audit-bsm.c
|
|
||||||
--- a/openssh-6.6p1/audit-bsm.c
|
|
||||||
+++ b/openssh-6.6p1/audit-bsm.c
|
|
||||||
@@ -468,9 +468,21 @@ audit_event(ssh_audit_event_t event)
|
|
||||||
case SSH_AUTH_FAIL_KBDINT:
|
|
||||||
bsm_audit_bad_login("interactive password entry");
|
|
||||||
break;
|
|
||||||
|
|
||||||
default:
|
|
||||||
debug("%s: unhandled event %d", __func__, event);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
+
|
|
||||||
+void
|
|
||||||
+audit_unsupported_body(int what)
|
|
||||||
+{
|
|
||||||
+ /* not implemented */
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+void
|
|
||||||
+audit_kex_body(int ctos, char *enc, char *mac, char *compress, pid_t pid, uid_t uid)
|
|
||||||
+{
|
|
||||||
+ /* not implemented */
|
|
||||||
+}
|
|
||||||
#endif /* BSM */
|
|
||||||
diff --git a/openssh-6.6p1/audit-linux.c b/openssh-6.6p1/audit-linux.c
|
|
||||||
--- a/openssh-6.6p1/audit-linux.c
|
|
||||||
+++ b/openssh-6.6p1/audit-linux.c
|
|
||||||
@@ -35,16 +35,18 @@
|
|
||||||
|
|
||||||
#include "log.h"
|
|
||||||
#include "audit.h"
|
|
||||||
#include "key.h"
|
|
||||||
#include "hostfile.h"
|
|
||||||
#include "auth.h"
|
|
||||||
#include "servconf.h"
|
|
||||||
#include "canohost.h"
|
|
||||||
+#include "packet.h"
|
|
||||||
+#include "cipher.h"
|
|
||||||
|
|
||||||
#define AUDIT_LOG_SIZE 128
|
|
||||||
|
|
||||||
extern ServerOptions options;
|
|
||||||
extern Authctxt *the_authctxt;
|
|
||||||
extern u_int utmp_len;
|
|
||||||
const char* audit_username(void);
|
|
||||||
|
|
||||||
@@ -264,9 +266,65 @@ audit_event(ssh_audit_event_t event)
|
|
||||||
get_remote_ipaddr(), "ssh", 0, AUDIT_USER_LOGIN);
|
|
||||||
break;
|
|
||||||
|
|
||||||
default:
|
|
||||||
debug("%s: unhandled event %d", __func__, event);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
+void
|
|
||||||
+audit_unsupported_body(int what)
|
|
||||||
+{
|
|
||||||
+#ifdef AUDIT_CRYPTO_SESSION
|
|
||||||
+ char buf[AUDIT_LOG_SIZE];
|
|
||||||
+ const static char *name[] = { "cipher", "mac", "comp" };
|
|
||||||
+ char *s;
|
|
||||||
+ int audit_fd;
|
|
||||||
+
|
|
||||||
+ snprintf(buf, sizeof(buf), "op=unsupported-%s direction=? cipher=? ksize=? rport=%d laddr=%s lport=%d ",
|
|
||||||
+ name[what], get_remote_port(), (s = get_local_ipaddr(packet_get_connection_in())),
|
|
||||||
+ get_local_port());
|
|
||||||
+ free(s);
|
|
||||||
+ audit_fd = audit_open();
|
|
||||||
+ if (audit_fd < 0)
|
|
||||||
+ /* no problem, the next instruction will be fatal() */
|
|
||||||
+ return;
|
|
||||||
+ audit_log_user_message(audit_fd, AUDIT_CRYPTO_SESSION,
|
|
||||||
+ buf, NULL, get_remote_ipaddr(), NULL, 0);
|
|
||||||
+ audit_close(audit_fd);
|
|
||||||
+#endif
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+void
|
|
||||||
+audit_kex_body(int ctos, char *enc, char *mac, char *compress, pid_t pid,
|
|
||||||
+ uid_t uid)
|
|
||||||
+{
|
|
||||||
+#ifdef AUDIT_CRYPTO_SESSION
|
|
||||||
+ char buf[AUDIT_LOG_SIZE];
|
|
||||||
+ int audit_fd, audit_ok;
|
|
||||||
+ const static char *direction[] = { "from-server", "from-client", "both" };
|
|
||||||
+ Cipher *cipher = cipher_by_name(enc);
|
|
||||||
+ char *s;
|
|
||||||
+
|
|
||||||
+ snprintf(buf, sizeof(buf), "op=start direction=%s cipher=%s ksize=%d spid=%jd suid=%jd rport=%d laddr=%s lport=%d ",
|
|
||||||
+ direction[ctos], enc, cipher ? 8 * cipher->key_len : 0,
|
|
||||||
+ (intmax_t)pid, (intmax_t)uid,
|
|
||||||
+ get_remote_port(), (s = get_local_ipaddr(packet_get_connection_in())), get_local_port());
|
|
||||||
+ free(s);
|
|
||||||
+ audit_fd = audit_open();
|
|
||||||
+ if (audit_fd < 0) {
|
|
||||||
+ if (errno == EINVAL || errno == EPROTONOSUPPORT ||
|
|
||||||
+ errno == EAFNOSUPPORT)
|
|
||||||
+ return; /* No audit support in kernel */
|
|
||||||
+ else
|
|
||||||
+ fatal("cannot open audit"); /* Must prevent login */
|
|
||||||
+ }
|
|
||||||
+ audit_ok = audit_log_user_message(audit_fd, AUDIT_CRYPTO_SESSION,
|
|
||||||
+ buf, NULL, get_remote_ipaddr(), NULL, 1);
|
|
||||||
+ audit_close(audit_fd);
|
|
||||||
+ /* do not abort if the error is EPERM and sshd is run as non root user */
|
|
||||||
+ if ((audit_ok < 0) && ((audit_ok != -1) || (getuid() == 0)))
|
|
||||||
+ fatal("cannot write into audit"); /* Must prevent login */
|
|
||||||
+#endif
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
#endif /* USE_LINUX_AUDIT */
|
|
||||||
diff --git a/openssh-6.6p1/audit.c b/openssh-6.6p1/audit.c
|
|
||||||
--- a/openssh-6.6p1/audit.c
|
|
||||||
+++ b/openssh-6.6p1/audit.c
|
|
||||||
@@ -23,24 +23,27 @@
|
|
||||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
|
||||||
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
||||||
*/
|
|
||||||
|
|
||||||
#include "includes.h"
|
|
||||||
|
|
||||||
#include <stdarg.h>
|
|
||||||
#include <string.h>
|
|
||||||
+#include <unistd.h>
|
|
||||||
|
|
||||||
#ifdef SSH_AUDIT_EVENTS
|
|
||||||
|
|
||||||
#include "audit.h"
|
|
||||||
#include "log.h"
|
|
||||||
#include "key.h"
|
|
||||||
#include "hostfile.h"
|
|
||||||
#include "auth.h"
|
|
||||||
+#include "ssh-gss.h"
|
|
||||||
+#include "monitor_wrap.h"
|
|
||||||
#include "xmalloc.h"
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Care must be taken when using this since it WILL NOT be initialized when
|
|
||||||
* audit_connection_from() is called and MAY NOT be initialized when
|
|
||||||
* audit_event(CONNECTION_ABANDON) is called. Test for NULL before using.
|
|
||||||
*/
|
|
||||||
extern Authctxt *the_authctxt;
|
|
||||||
@@ -123,16 +126,28 @@ audit_key(int host_user, int *rv, const
|
|
||||||
crypto_name = "ssh-rsa1";
|
|
||||||
else
|
|
||||||
crypto_name = key_ssh_name(key);
|
|
||||||
if (audit_keyusage(host_user, crypto_name, key_size(key), fp, *rv) == 0)
|
|
||||||
*rv = 0;
|
|
||||||
free(fp);
|
|
||||||
}
|
|
||||||
|
|
||||||
+void
|
|
||||||
+audit_unsupported(int what)
|
|
||||||
+{
|
|
||||||
+ PRIVSEP(audit_unsupported_body(what));
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+void
|
|
||||||
+audit_kex(int ctos, char *enc, char *mac, char *comp)
|
|
||||||
+{
|
|
||||||
+ PRIVSEP(audit_kex_body(ctos, enc, mac, comp, getpid(), getuid()));
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
# ifndef CUSTOM_SSH_AUDIT_EVENTS
|
|
||||||
/*
|
|
||||||
* Null implementations of audit functions.
|
|
||||||
* These get used if SSH_AUDIT_EVENTS is defined but no audit module is enabled.
|
|
||||||
*/
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Called after a connection has been accepted but before any authentication
|
|
||||||
@@ -233,10 +248,31 @@ audit_end_command(int handle, const char
|
|
||||||
*/
|
|
||||||
int
|
|
||||||
audit_keyusage(int host_user, const char *type, unsigned bits, char *fp, int rv)
|
|
||||||
{
|
|
||||||
debug("audit %s key usage euid %d user %s key type %s key length %d fingerprint %s, result %d",
|
|
||||||
host_user ? "pubkey" : "hostbased", geteuid(), audit_username(), type, bits,
|
|
||||||
fp, rv);
|
|
||||||
}
|
|
||||||
+
|
|
||||||
+/*
|
|
||||||
+ * This will be called when the protocol negotiation fails.
|
|
||||||
+ */
|
|
||||||
+void
|
|
||||||
+audit_unsupported_body(int what)
|
|
||||||
+{
|
|
||||||
+ debug("audit unsupported protocol euid %d type %d", geteuid(), what);
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+/*
|
|
||||||
+ * This will be called on succesfull protocol negotiation.
|
|
||||||
+ */
|
|
||||||
+void
|
|
||||||
+audit_kex_body(int ctos, char *enc, char *mac, char *compress, pid_t pid,
|
|
||||||
+ uid_t uid)
|
|
||||||
+{
|
|
||||||
+ debug("audit protocol negotiation euid %d direction %d cipher %s mac %s compresion %s from pid %ld uid %u",
|
|
||||||
+ (unsigned)geteuid(), ctos, enc, mac, compress, (long)pid,
|
|
||||||
+ (unsigned)uid);
|
|
||||||
+}
|
|
||||||
# endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */
|
|
||||||
#endif /* SSH_AUDIT_EVENTS */
|
|
||||||
diff --git a/openssh-6.6p1/audit.h b/openssh-6.6p1/audit.h
|
|
||||||
--- a/openssh-6.6p1/audit.h
|
|
||||||
+++ b/openssh-6.6p1/audit.h
|
|
||||||
@@ -53,10 +53,14 @@ void audit_event(ssh_audit_event_t);
|
|
||||||
void audit_count_session_open(void);
|
|
||||||
void audit_session_open(struct logininfo *);
|
|
||||||
void audit_session_close(struct logininfo *);
|
|
||||||
int audit_run_command(const char *);
|
|
||||||
void audit_end_command(int, const char *);
|
|
||||||
ssh_audit_event_t audit_classify_auth(const char *);
|
|
||||||
int audit_keyusage(int, const char *, unsigned, char *, int);
|
|
||||||
void audit_key(int, int *, const Key *);
|
|
||||||
+void audit_unsupported(int);
|
|
||||||
+void audit_kex(int, char *, char *, char *);
|
|
||||||
+void audit_unsupported_body(int);
|
|
||||||
+void audit_kex_body(int, char *, char *, char *, pid_t, uid_t);
|
|
||||||
|
|
||||||
#endif /* _SSH_AUDIT_H */
|
|
||||||
diff --git a/openssh-6.6p1/auditstub.c b/openssh-6.6p1/auditstub.c
|
|
||||||
new file mode 100644
|
|
||||||
--- /dev/null
|
|
||||||
+++ b/openssh-6.6p1/auditstub.c
|
|
||||||
@@ -0,0 +1,39 @@
|
|
||||||
+/* $Id: auditstub.c,v 1.1 jfch Exp $ */
|
|
||||||
+
|
|
||||||
+/*
|
|
||||||
+ * Copyright 2010 Red Hat, Inc. All rights reserved.
|
|
||||||
+ * Use is subject to license terms.
|
|
||||||
+ *
|
|
||||||
+ * Redistribution and use in source and binary forms, with or without
|
|
||||||
+ * modification, are permitted provided that the following conditions
|
|
||||||
+ * are met:
|
|
||||||
+ * 1. Redistributions of source code must retain the above copyright
|
|
||||||
+ * notice, this list of conditions and the following disclaimer.
|
|
||||||
+ * 2. Redistributions in binary form must reproduce the above copyright
|
|
||||||
+ * notice, this list of conditions and the following disclaimer in the
|
|
||||||
+ * documentation and/or other materials provided with the distribution.
|
|
||||||
+ *
|
|
||||||
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
|
|
||||||
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
|
||||||
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
|
|
||||||
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
|
|
||||||
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
|
||||||
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
|
||||||
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
||||||
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
|
||||||
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
|
||||||
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
||||||
+ *
|
|
||||||
+ * Red Hat author: Jan F. Chadima <jchadima@redhat.com>
|
|
||||||
+ */
|
|
||||||
+
|
|
||||||
+void
|
|
||||||
+audit_unsupported(int n)
|
|
||||||
+{
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+void
|
|
||||||
+audit_kex(int ctos, char *enc, char *mac, char *comp)
|
|
||||||
+{
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
diff --git a/openssh-6.6p1/cipher.h b/openssh-6.6p1/cipher.h
|
|
||||||
--- a/openssh-6.6p1/cipher.h
|
|
||||||
+++ b/openssh-6.6p1/cipher.h
|
|
||||||
@@ -58,17 +58,30 @@
|
|
||||||
#define SSH_CIPHER_MAX 31
|
|
||||||
|
|
||||||
#define CIPHER_ENCRYPT 1
|
|
||||||
#define CIPHER_DECRYPT 0
|
|
||||||
|
|
||||||
typedef struct Cipher Cipher;
|
|
||||||
typedef struct CipherContext CipherContext;
|
|
||||||
|
|
||||||
-struct Cipher;
|
|
||||||
+struct Cipher {
|
|
||||||
+ char *name;
|
|
||||||
+ int number; /* for ssh1 only */
|
|
||||||
+ u_int block_size;
|
|
||||||
+ u_int key_len;
|
|
||||||
+ u_int iv_len; /* defaults to block_size */
|
|
||||||
+ u_int auth_len;
|
|
||||||
+ u_int discard_len;
|
|
||||||
+ u_int flags;
|
|
||||||
+#define CFLAG_CBC (1<<0)
|
|
||||||
+#define CFLAG_CHACHAPOLY (1<<1)
|
|
||||||
+ const EVP_CIPHER *(*evptype)(void);
|
|
||||||
+};
|
|
||||||
+
|
|
||||||
struct CipherContext {
|
|
||||||
int plaintext;
|
|
||||||
int encrypt;
|
|
||||||
EVP_CIPHER_CTX evp;
|
|
||||||
struct chachapoly_ctx cp_ctx; /* XXX union with evp? */
|
|
||||||
const Cipher *cipher;
|
|
||||||
};
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/kex.c b/openssh-6.6p1/kex.c
|
|
||||||
--- a/openssh-6.6p1/kex.c
|
|
||||||
+++ b/openssh-6.6p1/kex.c
|
|
||||||
@@ -45,16 +45,17 @@
|
|
||||||
#include "kex.h"
|
|
||||||
#include "log.h"
|
|
||||||
#include "mac.h"
|
|
||||||
#include "match.h"
|
|
||||||
#include "dispatch.h"
|
|
||||||
#include "monitor.h"
|
|
||||||
#include "roaming.h"
|
|
||||||
#include "digest.h"
|
|
||||||
+#include "audit.h"
|
|
||||||
|
|
||||||
#if OPENSSL_VERSION_NUMBER >= 0x00907000L
|
|
||||||
# if defined(HAVE_EVP_SHA256)
|
|
||||||
# define evp_ssh_sha256 EVP_sha256
|
|
||||||
# else
|
|
||||||
extern const EVP_MD *evp_ssh_sha256(void);
|
|
||||||
# endif
|
|
||||||
#endif
|
|
||||||
@@ -346,53 +347,65 @@ kex_kexinit_finish(Kex *kex)
|
|
||||||
fatal("Unsupported key exchange %d", kex->kex_type);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
static void
|
|
||||||
choose_enc(Enc *enc, char *client, char *server)
|
|
||||||
{
|
|
||||||
char *name = match_list(client, server, NULL);
|
|
||||||
- if (name == NULL)
|
|
||||||
+ if (name == NULL) {
|
|
||||||
+#ifdef SSH_AUDIT_EVENTS
|
|
||||||
+ audit_unsupported(0);
|
|
||||||
+#endif
|
|
||||||
fatal("no matching cipher found: client %s server %s",
|
|
||||||
client, server);
|
|
||||||
+ }
|
|
||||||
if ((enc->cipher = cipher_by_name(name)) == NULL)
|
|
||||||
fatal("matching cipher is not supported: %s", name);
|
|
||||||
enc->name = name;
|
|
||||||
enc->enabled = 0;
|
|
||||||
enc->iv = NULL;
|
|
||||||
enc->iv_len = cipher_ivlen(enc->cipher);
|
|
||||||
enc->key = NULL;
|
|
||||||
enc->key_len = cipher_keylen(enc->cipher);
|
|
||||||
enc->block_size = cipher_blocksize(enc->cipher);
|
|
||||||
}
|
|
||||||
|
|
||||||
static void
|
|
||||||
choose_mac(Mac *mac, char *client, char *server)
|
|
||||||
{
|
|
||||||
char *name = match_list(client, server, NULL);
|
|
||||||
- if (name == NULL)
|
|
||||||
+ if (name == NULL) {
|
|
||||||
+#ifdef SSH_AUDIT_EVENTS
|
|
||||||
+ audit_unsupported(1);
|
|
||||||
+#endif
|
|
||||||
fatal("no matching mac found: client %s server %s",
|
|
||||||
client, server);
|
|
||||||
+ }
|
|
||||||
if (mac_setup(mac, name) < 0)
|
|
||||||
fatal("unsupported mac %s", name);
|
|
||||||
/* truncate the key */
|
|
||||||
if (datafellows & SSH_BUG_HMAC)
|
|
||||||
mac->key_len = 16;
|
|
||||||
mac->name = name;
|
|
||||||
mac->key = NULL;
|
|
||||||
mac->enabled = 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void
|
|
||||||
choose_comp(Comp *comp, char *client, char *server)
|
|
||||||
{
|
|
||||||
char *name = match_list(client, server, NULL);
|
|
||||||
- if (name == NULL)
|
|
||||||
+ if (name == NULL) {
|
|
||||||
+#ifdef SSH_AUDIT_EVENTS
|
|
||||||
+ audit_unsupported(2);
|
|
||||||
+#endif
|
|
||||||
fatal("no matching comp found: client %s server %s", client, server);
|
|
||||||
+ }
|
|
||||||
if (strcmp(name, "zlib@openssh.com") == 0) {
|
|
||||||
comp->type = COMP_DELAYED;
|
|
||||||
} else if (strcmp(name, "zlib") == 0) {
|
|
||||||
comp->type = COMP_ZLIB;
|
|
||||||
} else if (strcmp(name, "none") == 0) {
|
|
||||||
comp->type = COMP_NONE;
|
|
||||||
} else {
|
|
||||||
fatal("unsupported comp %s", name);
|
|
||||||
@@ -497,16 +510,19 @@ kex_choose_conf(Kex *kex)
|
|
||||||
if (authlen == 0)
|
|
||||||
choose_mac(&newkeys->mac, cprop[nmac], sprop[nmac]);
|
|
||||||
choose_comp(&newkeys->comp, cprop[ncomp], sprop[ncomp]);
|
|
||||||
debug("kex: %s %s %s %s",
|
|
||||||
ctos ? "client->server" : "server->client",
|
|
||||||
newkeys->enc.name,
|
|
||||||
authlen == 0 ? newkeys->mac.name : "<implicit>",
|
|
||||||
newkeys->comp.name);
|
|
||||||
+#ifdef SSH_AUDIT_EVENTS
|
|
||||||
+ audit_kex(ctos, newkeys->enc.name, newkeys->mac.name, newkeys->comp.name);
|
|
||||||
+#endif
|
|
||||||
}
|
|
||||||
choose_kex(kex, cprop[PROPOSAL_KEX_ALGS], sprop[PROPOSAL_KEX_ALGS]);
|
|
||||||
choose_hostkeyalg(kex, cprop[PROPOSAL_SERVER_HOST_KEY_ALGS],
|
|
||||||
sprop[PROPOSAL_SERVER_HOST_KEY_ALGS]);
|
|
||||||
need = dh_need = 0;
|
|
||||||
for (mode = 0; mode < MODE_MAX; mode++) {
|
|
||||||
newkeys = kex->newkeys[mode];
|
|
||||||
need = MAX(need, newkeys->enc.key_len);
|
|
||||||
diff --git a/openssh-6.6p1/monitor.c b/openssh-6.6p1/monitor.c
|
|
||||||
--- a/openssh-6.6p1/monitor.c
|
|
||||||
+++ b/openssh-6.6p1/monitor.c
|
|
||||||
@@ -92,16 +92,17 @@
|
|
||||||
#endif
|
|
||||||
#include "monitor_wrap.h"
|
|
||||||
#include "monitor_fdpass.h"
|
|
||||||
#include "misc.h"
|
|
||||||
#include "compat.h"
|
|
||||||
#include "ssh2.h"
|
|
||||||
#include "roaming.h"
|
|
||||||
#include "authfd.h"
|
|
||||||
+#include "audit.h"
|
|
||||||
|
|
||||||
#ifdef GSSAPI
|
|
||||||
static Gssctxt *gsscontext = NULL;
|
|
||||||
#endif
|
|
||||||
|
|
||||||
/* Imports */
|
|
||||||
extern ServerOptions options;
|
|
||||||
extern u_int utmp_len;
|
|
||||||
@@ -176,16 +177,18 @@ int mm_answer_gss_accept_ctx(int, Buffer
|
|
||||||
int mm_answer_gss_userok(int, Buffer *);
|
|
||||||
int mm_answer_gss_checkmic(int, Buffer *);
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#ifdef SSH_AUDIT_EVENTS
|
|
||||||
int mm_answer_audit_event(int, Buffer *);
|
|
||||||
int mm_answer_audit_command(int, Buffer *);
|
|
||||||
int mm_answer_audit_end_command(int, Buffer *);
|
|
||||||
+int mm_answer_audit_unsupported_body(int, Buffer *);
|
|
||||||
+int mm_answer_audit_kex_body(int, Buffer *);
|
|
||||||
#endif
|
|
||||||
|
|
||||||
static int monitor_read_log(struct monitor *);
|
|
||||||
|
|
||||||
static Authctxt *authctxt;
|
|
||||||
static BIGNUM *ssh1_challenge = NULL; /* used for ssh1 rsa auth */
|
|
||||||
|
|
||||||
/* local state for key verify */
|
|
||||||
@@ -227,16 +230,18 @@ struct mon_table mon_dispatch_proto20[]
|
|
||||||
{MONITOR_REQ_PAM_ACCOUNT, 0, mm_answer_pam_account},
|
|
||||||
{MONITOR_REQ_PAM_INIT_CTX, MON_ISAUTH, mm_answer_pam_init_ctx},
|
|
||||||
{MONITOR_REQ_PAM_QUERY, MON_ISAUTH, mm_answer_pam_query},
|
|
||||||
{MONITOR_REQ_PAM_RESPOND, MON_ISAUTH, mm_answer_pam_respond},
|
|
||||||
{MONITOR_REQ_PAM_FREE_CTX, MON_ONCE|MON_AUTHDECIDE, mm_answer_pam_free_ctx},
|
|
||||||
#endif
|
|
||||||
#ifdef SSH_AUDIT_EVENTS
|
|
||||||
{MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
|
|
||||||
+ {MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},
|
|
||||||
+ {MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},
|
|
||||||
#endif
|
|
||||||
#ifdef BSD_AUTH
|
|
||||||
{MONITOR_REQ_BSDAUTHQUERY, MON_ISAUTH, mm_answer_bsdauthquery},
|
|
||||||
{MONITOR_REQ_BSDAUTHRESPOND, MON_AUTH, mm_answer_bsdauthrespond},
|
|
||||||
#endif
|
|
||||||
#ifdef SKEY
|
|
||||||
{MONITOR_REQ_SKEYQUERY, MON_ISAUTH, mm_answer_skeyquery},
|
|
||||||
{MONITOR_REQ_SKEYRESPOND, MON_AUTH, mm_answer_skeyrespond},
|
|
||||||
@@ -257,16 +262,18 @@ struct mon_table mon_dispatch_postauth20
|
|
||||||
{MONITOR_REQ_SIGN, 0, mm_answer_sign},
|
|
||||||
{MONITOR_REQ_PTY, 0, mm_answer_pty},
|
|
||||||
{MONITOR_REQ_PTYCLEANUP, 0, mm_answer_pty_cleanup},
|
|
||||||
{MONITOR_REQ_TERM, 0, mm_answer_term},
|
|
||||||
#ifdef SSH_AUDIT_EVENTS
|
|
||||||
{MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
|
|
||||||
{MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT, mm_answer_audit_command},
|
|
||||||
{MONITOR_REQ_AUDIT_END_COMMAND, MON_PERMIT, mm_answer_audit_end_command},
|
|
||||||
+ {MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},
|
|
||||||
+ {MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},
|
|
||||||
#endif
|
|
||||||
{0, 0, NULL}
|
|
||||||
};
|
|
||||||
|
|
||||||
struct mon_table mon_dispatch_proto15[] = {
|
|
||||||
{MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow},
|
|
||||||
{MONITOR_REQ_SESSKEY, MON_ONCE, mm_answer_sesskey},
|
|
||||||
{MONITOR_REQ_SESSID, MON_ONCE, mm_answer_sessid},
|
|
||||||
@@ -288,28 +295,32 @@ struct mon_table mon_dispatch_proto15[]
|
|
||||||
{MONITOR_REQ_PAM_ACCOUNT, 0, mm_answer_pam_account},
|
|
||||||
{MONITOR_REQ_PAM_INIT_CTX, MON_ISAUTH, mm_answer_pam_init_ctx},
|
|
||||||
{MONITOR_REQ_PAM_QUERY, MON_ISAUTH, mm_answer_pam_query},
|
|
||||||
{MONITOR_REQ_PAM_RESPOND, MON_ISAUTH, mm_answer_pam_respond},
|
|
||||||
{MONITOR_REQ_PAM_FREE_CTX, MON_ONCE|MON_AUTHDECIDE, mm_answer_pam_free_ctx},
|
|
||||||
#endif
|
|
||||||
#ifdef SSH_AUDIT_EVENTS
|
|
||||||
{MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
|
|
||||||
+ {MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},
|
|
||||||
+ {MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},
|
|
||||||
#endif
|
|
||||||
{0, 0, NULL}
|
|
||||||
};
|
|
||||||
|
|
||||||
struct mon_table mon_dispatch_postauth15[] = {
|
|
||||||
{MONITOR_REQ_PTY, MON_ONCE, mm_answer_pty},
|
|
||||||
{MONITOR_REQ_PTYCLEANUP, MON_ONCE, mm_answer_pty_cleanup},
|
|
||||||
{MONITOR_REQ_TERM, 0, mm_answer_term},
|
|
||||||
#ifdef SSH_AUDIT_EVENTS
|
|
||||||
{MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
|
|
||||||
{MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT|MON_ONCE, mm_answer_audit_command},
|
|
||||||
{MONITOR_REQ_AUDIT_END_COMMAND, MON_PERMIT, mm_answer_audit_end_command},
|
|
||||||
+ {MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},
|
|
||||||
+ {MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},
|
|
||||||
#endif
|
|
||||||
{0, 0, NULL}
|
|
||||||
};
|
|
||||||
|
|
||||||
struct mon_table *mon_dispatch;
|
|
||||||
|
|
||||||
/* Specifies if a certain message is allowed at the moment */
|
|
||||||
|
|
||||||
@@ -2187,8 +2198,52 @@ mm_answer_gss_userok(int sock, Buffer *m
|
|
||||||
|
|
||||||
auth_method = "gssapi-with-mic";
|
|
||||||
|
|
||||||
/* Monitor loop will terminate if authenticated */
|
|
||||||
return (authenticated);
|
|
||||||
}
|
|
||||||
#endif /* GSSAPI */
|
|
||||||
|
|
||||||
+#ifdef SSH_AUDIT_EVENTS
|
|
||||||
+int
|
|
||||||
+mm_answer_audit_unsupported_body(int sock, Buffer *m)
|
|
||||||
+{
|
|
||||||
+ int what;
|
|
||||||
+
|
|
||||||
+ what = buffer_get_int(m);
|
|
||||||
+
|
|
||||||
+ audit_unsupported_body(what);
|
|
||||||
+
|
|
||||||
+ buffer_clear(m);
|
|
||||||
+
|
|
||||||
+ mm_request_send(sock, MONITOR_ANS_AUDIT_UNSUPPORTED, m);
|
|
||||||
+ return 0;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+int
|
|
||||||
+mm_answer_audit_kex_body(int sock, Buffer *m)
|
|
||||||
+{
|
|
||||||
+ int ctos, len;
|
|
||||||
+ char *cipher, *mac, *compress;
|
|
||||||
+ pid_t pid;
|
|
||||||
+ uid_t uid;
|
|
||||||
+
|
|
||||||
+ ctos = buffer_get_int(m);
|
|
||||||
+ cipher = buffer_get_string(m, &len);
|
|
||||||
+ mac = buffer_get_string(m, &len);
|
|
||||||
+ compress = buffer_get_string(m, &len);
|
|
||||||
+ pid = buffer_get_int64(m);
|
|
||||||
+ uid = buffer_get_int64(m);
|
|
||||||
+
|
|
||||||
+ audit_kex_body(ctos, cipher, mac, compress, pid, uid);
|
|
||||||
+
|
|
||||||
+ free(cipher);
|
|
||||||
+ free(mac);
|
|
||||||
+ free(compress);
|
|
||||||
+ buffer_clear(m);
|
|
||||||
+
|
|
||||||
+ mm_request_send(sock, MONITOR_ANS_AUDIT_KEX, m);
|
|
||||||
+ return 0;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+#endif /* SSH_AUDIT_EVENTS */
|
|
||||||
+
|
|
||||||
diff --git a/openssh-6.6p1/monitor.h b/openssh-6.6p1/monitor.h
|
|
||||||
--- a/openssh-6.6p1/monitor.h
|
|
||||||
+++ b/openssh-6.6p1/monitor.h
|
|
||||||
@@ -60,16 +60,18 @@ enum monitor_reqtype {
|
|
||||||
MONITOR_REQ_PAM_START = 100,
|
|
||||||
MONITOR_REQ_PAM_ACCOUNT = 102, MONITOR_ANS_PAM_ACCOUNT = 103,
|
|
||||||
MONITOR_REQ_PAM_INIT_CTX = 104, MONITOR_ANS_PAM_INIT_CTX = 105,
|
|
||||||
MONITOR_REQ_PAM_QUERY = 106, MONITOR_ANS_PAM_QUERY = 107,
|
|
||||||
MONITOR_REQ_PAM_RESPOND = 108, MONITOR_ANS_PAM_RESPOND = 109,
|
|
||||||
MONITOR_REQ_PAM_FREE_CTX = 110, MONITOR_ANS_PAM_FREE_CTX = 111,
|
|
||||||
MONITOR_REQ_AUDIT_EVENT = 112, MONITOR_REQ_AUDIT_COMMAND = 113,
|
|
||||||
MONITOR_ANS_AUDIT_COMMAND = 114, MONITOR_REQ_AUDIT_END_COMMAND = 115,
|
|
||||||
+ MONITOR_REQ_AUDIT_UNSUPPORTED = 116, MONITOR_ANS_AUDIT_UNSUPPORTED = 117,
|
|
||||||
+ MONITOR_REQ_AUDIT_KEX = 118, MONITOR_ANS_AUDIT_KEX = 119,
|
|
||||||
|
|
||||||
};
|
|
||||||
|
|
||||||
struct mm_master;
|
|
||||||
struct monitor {
|
|
||||||
int m_recvfd;
|
|
||||||
int m_sendfd;
|
|
||||||
int m_log_recvfd;
|
|
||||||
diff --git a/openssh-6.6p1/monitor_wrap.c b/openssh-6.6p1/monitor_wrap.c
|
|
||||||
--- a/openssh-6.6p1/monitor_wrap.c
|
|
||||||
+++ b/openssh-6.6p1/monitor_wrap.c
|
|
||||||
@@ -1320,8 +1320,46 @@ mm_ssh_gssapi_userok(char *user)
|
|
||||||
authenticated = buffer_get_int(&m);
|
|
||||||
|
|
||||||
buffer_free(&m);
|
|
||||||
debug3("%s: user %sauthenticated",__func__, authenticated ? "" : "not ");
|
|
||||||
return (authenticated);
|
|
||||||
}
|
|
||||||
#endif /* GSSAPI */
|
|
||||||
|
|
||||||
+#ifdef SSH_AUDIT_EVENTS
|
|
||||||
+void
|
|
||||||
+mm_audit_unsupported_body(int what)
|
|
||||||
+{
|
|
||||||
+ Buffer m;
|
|
||||||
+
|
|
||||||
+ buffer_init(&m);
|
|
||||||
+ buffer_put_int(&m, what);
|
|
||||||
+
|
|
||||||
+ mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_UNSUPPORTED, &m);
|
|
||||||
+ mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_AUDIT_UNSUPPORTED,
|
|
||||||
+ &m);
|
|
||||||
+
|
|
||||||
+ buffer_free(&m);
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+void
|
|
||||||
+mm_audit_kex_body(int ctos, char *cipher, char *mac, char *compress, pid_t pid,
|
|
||||||
+ uid_t uid)
|
|
||||||
+{
|
|
||||||
+ Buffer m;
|
|
||||||
+
|
|
||||||
+ buffer_init(&m);
|
|
||||||
+ buffer_put_int(&m, ctos);
|
|
||||||
+ buffer_put_cstring(&m, cipher ? cipher : "");
|
|
||||||
+ buffer_put_cstring(&m, mac ? mac : "");
|
|
||||||
+ buffer_put_cstring(&m, compress ? compress : "");
|
|
||||||
+ buffer_put_int64(&m, pid);
|
|
||||||
+ buffer_put_int64(&m, uid);
|
|
||||||
+
|
|
||||||
+ mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_KEX, &m);
|
|
||||||
+ mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_AUDIT_KEX,
|
|
||||||
+ &m);
|
|
||||||
+
|
|
||||||
+ buffer_free(&m);
|
|
||||||
+}
|
|
||||||
+#endif /* SSH_AUDIT_EVENTS */
|
|
||||||
+
|
|
||||||
diff --git a/openssh-6.6p1/monitor_wrap.h b/openssh-6.6p1/monitor_wrap.h
|
|
||||||
--- a/openssh-6.6p1/monitor_wrap.h
|
|
||||||
+++ b/openssh-6.6p1/monitor_wrap.h
|
|
||||||
@@ -72,16 +72,18 @@ int mm_sshpam_respond(void *, u_int, cha
|
|
||||||
void mm_sshpam_free_ctx(void *);
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#ifdef SSH_AUDIT_EVENTS
|
|
||||||
#include "audit.h"
|
|
||||||
void mm_audit_event(ssh_audit_event_t);
|
|
||||||
int mm_audit_run_command(const char *);
|
|
||||||
void mm_audit_end_command(int, const char *);
|
|
||||||
+void mm_audit_unsupported_body(int);
|
|
||||||
+void mm_audit_kex_body(int, char *, char *, char *, pid_t, uid_t);
|
|
||||||
#endif
|
|
||||||
|
|
||||||
struct Session;
|
|
||||||
void mm_terminate(void);
|
|
||||||
int mm_pty_allocate(int *, int *, char *, size_t);
|
|
||||||
void mm_session_pty_cleanup2(struct Session *);
|
|
||||||
|
|
||||||
/* SSHv1 interfaces */
|
|
||||||
diff --git a/openssh-6.6p1/sshd.c b/openssh-6.6p1/sshd.c
|
|
||||||
--- a/openssh-6.6p1/sshd.c
|
|
||||||
+++ b/openssh-6.6p1/sshd.c
|
|
||||||
@@ -2325,16 +2325,20 @@ do_ssh1_kex(void)
|
|
||||||
packet_disconnect("Warning: client selects unsupported cipher.");
|
|
||||||
|
|
||||||
/* Get check bytes from the packet. These must match those we
|
|
||||||
sent earlier with the public key packet. */
|
|
||||||
for (i = 0; i < 8; i++)
|
|
||||||
if (cookie[i] != packet_get_char())
|
|
||||||
packet_disconnect("IP Spoofing check bytes do not match.");
|
|
||||||
|
|
||||||
+#ifdef SSH_AUDIT_EVENTS
|
|
||||||
+ audit_kex(2, cipher_name(cipher_type), "crc", "none");
|
|
||||||
+#endif
|
|
||||||
+
|
|
||||||
debug("Encryption type: %.200s", cipher_name(cipher_type));
|
|
||||||
|
|
||||||
/* Get the encrypted integer. */
|
|
||||||
if ((session_key_int = BN_new()) == NULL)
|
|
||||||
fatal("do_ssh1_kex: BN_new failed");
|
|
||||||
packet_get_bignum(session_key_int);
|
|
||||||
|
|
||||||
protocol_flags = packet_get_int();
|
|
@ -1,983 +0,0 @@
|
|||||||
# session key destruction and auditing
|
|
||||||
# based on:
|
|
||||||
# https://bugzilla.mindrot.org/show_bug.cgi?id=1402
|
|
||||||
# https://bugzilla.mindrot.org/attachment.cgi?id=2014
|
|
||||||
# by jchadima@redhat.com
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/audit-bsm.c b/openssh-6.6p1/audit-bsm.c
|
|
||||||
--- a/openssh-6.6p1/audit-bsm.c
|
|
||||||
+++ b/openssh-6.6p1/audit-bsm.c
|
|
||||||
@@ -480,9 +480,15 @@ audit_unsupported_body(int what)
|
|
||||||
/* not implemented */
|
|
||||||
}
|
|
||||||
|
|
||||||
void
|
|
||||||
audit_kex_body(int ctos, char *enc, char *mac, char *compress, pid_t pid, uid_t uid)
|
|
||||||
{
|
|
||||||
/* not implemented */
|
|
||||||
}
|
|
||||||
+
|
|
||||||
+void
|
|
||||||
+audit_session_key_free_body(int ctos, pid_t pid, uid_t uid)
|
|
||||||
+{
|
|
||||||
+ /* not implemented */
|
|
||||||
+}
|
|
||||||
#endif /* BSM */
|
|
||||||
diff --git a/openssh-6.6p1/audit-linux.c b/openssh-6.6p1/audit-linux.c
|
|
||||||
--- a/openssh-6.6p1/audit-linux.c
|
|
||||||
+++ b/openssh-6.6p1/audit-linux.c
|
|
||||||
@@ -289,24 +289,25 @@ audit_unsupported_body(int what)
|
|
||||||
/* no problem, the next instruction will be fatal() */
|
|
||||||
return;
|
|
||||||
audit_log_user_message(audit_fd, AUDIT_CRYPTO_SESSION,
|
|
||||||
buf, NULL, get_remote_ipaddr(), NULL, 0);
|
|
||||||
audit_close(audit_fd);
|
|
||||||
#endif
|
|
||||||
}
|
|
||||||
|
|
||||||
+const static char *direction[] = { "from-server", "from-client", "both" };
|
|
||||||
+
|
|
||||||
void
|
|
||||||
audit_kex_body(int ctos, char *enc, char *mac, char *compress, pid_t pid,
|
|
||||||
uid_t uid)
|
|
||||||
{
|
|
||||||
#ifdef AUDIT_CRYPTO_SESSION
|
|
||||||
char buf[AUDIT_LOG_SIZE];
|
|
||||||
int audit_fd, audit_ok;
|
|
||||||
- const static char *direction[] = { "from-server", "from-client", "both" };
|
|
||||||
Cipher *cipher = cipher_by_name(enc);
|
|
||||||
char *s;
|
|
||||||
|
|
||||||
snprintf(buf, sizeof(buf), "op=start direction=%s cipher=%s ksize=%d spid=%jd suid=%jd rport=%d laddr=%s lport=%d ",
|
|
||||||
direction[ctos], enc, cipher ? 8 * cipher->key_len : 0,
|
|
||||||
(intmax_t)pid, (intmax_t)uid,
|
|
||||||
get_remote_port(), (s = get_local_ipaddr(packet_get_connection_in())), get_local_port());
|
|
||||||
free(s);
|
|
||||||
@@ -322,9 +323,37 @@ audit_kex_body(int ctos, char *enc, char
|
|
||||||
buf, NULL, get_remote_ipaddr(), NULL, 1);
|
|
||||||
audit_close(audit_fd);
|
|
||||||
/* do not abort if the error is EPERM and sshd is run as non root user */
|
|
||||||
if ((audit_ok < 0) && ((audit_ok != -1) || (getuid() == 0)))
|
|
||||||
fatal("cannot write into audit"); /* Must prevent login */
|
|
||||||
#endif
|
|
||||||
}
|
|
||||||
|
|
||||||
+void
|
|
||||||
+audit_session_key_free_body(int ctos, pid_t pid, uid_t uid)
|
|
||||||
+{
|
|
||||||
+ char buf[AUDIT_LOG_SIZE];
|
|
||||||
+ int audit_fd, audit_ok;
|
|
||||||
+ char *s;
|
|
||||||
+
|
|
||||||
+ snprintf(buf, sizeof(buf), "op=destroy kind=session fp=? direction=%s spid=%jd suid=%jd rport=%d laddr=%s lport=%d ",
|
|
||||||
+ direction[ctos], (intmax_t)pid, (intmax_t)uid,
|
|
||||||
+ get_remote_port(),
|
|
||||||
+ (s = get_local_ipaddr(packet_get_connection_in())),
|
|
||||||
+ get_local_port());
|
|
||||||
+ free(s);
|
|
||||||
+ audit_fd = audit_open();
|
|
||||||
+ if (audit_fd < 0) {
|
|
||||||
+ if (errno != EINVAL && errno != EPROTONOSUPPORT &&
|
|
||||||
+ errno != EAFNOSUPPORT)
|
|
||||||
+ error("cannot open audit");
|
|
||||||
+ return;
|
|
||||||
+ }
|
|
||||||
+ audit_ok = audit_log_user_message(audit_fd, AUDIT_CRYPTO_KEY_USER,
|
|
||||||
+ buf, NULL, get_remote_ipaddr(), NULL, 1);
|
|
||||||
+ audit_close(audit_fd);
|
|
||||||
+ /* do not abort if the error is EPERM and sshd is run as non root user */
|
|
||||||
+ if ((audit_ok < 0) && ((audit_ok != -1) || (getuid() == 0)))
|
|
||||||
+ error("cannot write into audit");
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
#endif /* USE_LINUX_AUDIT */
|
|
||||||
diff --git a/openssh-6.6p1/audit.c b/openssh-6.6p1/audit.c
|
|
||||||
--- a/openssh-6.6p1/audit.c
|
|
||||||
+++ b/openssh-6.6p1/audit.c
|
|
||||||
@@ -138,16 +138,22 @@ audit_unsupported(int what)
|
|
||||||
}
|
|
||||||
|
|
||||||
void
|
|
||||||
audit_kex(int ctos, char *enc, char *mac, char *comp)
|
|
||||||
{
|
|
||||||
PRIVSEP(audit_kex_body(ctos, enc, mac, comp, getpid(), getuid()));
|
|
||||||
}
|
|
||||||
|
|
||||||
+void
|
|
||||||
+audit_session_key_free(int ctos)
|
|
||||||
+{
|
|
||||||
+ PRIVSEP(audit_session_key_free_body(ctos, getpid(), getuid()));
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
# ifndef CUSTOM_SSH_AUDIT_EVENTS
|
|
||||||
/*
|
|
||||||
* Null implementations of audit functions.
|
|
||||||
* These get used if SSH_AUDIT_EVENTS is defined but no audit module is enabled.
|
|
||||||
*/
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Called after a connection has been accepted but before any authentication
|
|
||||||
@@ -269,10 +275,20 @@ audit_unsupported_body(int what)
|
|
||||||
void
|
|
||||||
audit_kex_body(int ctos, char *enc, char *mac, char *compress, pid_t pid,
|
|
||||||
uid_t uid)
|
|
||||||
{
|
|
||||||
debug("audit protocol negotiation euid %d direction %d cipher %s mac %s compresion %s from pid %ld uid %u",
|
|
||||||
(unsigned)geteuid(), ctos, enc, mac, compress, (long)pid,
|
|
||||||
(unsigned)uid);
|
|
||||||
}
|
|
||||||
+
|
|
||||||
+/*
|
|
||||||
+ * This will be called on succesfull session key discard
|
|
||||||
+ */
|
|
||||||
+void
|
|
||||||
+audit_session_key_free_body(int ctos, pid_t pid, uid_t uid)
|
|
||||||
+{
|
|
||||||
+ debug("audit session key discard euid %u direction %d from pid %ld uid %u",
|
|
||||||
+ (unsigned)geteuid(), ctos, (long)pid, (unsigned)uid);
|
|
||||||
+}
|
|
||||||
# endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */
|
|
||||||
#endif /* SSH_AUDIT_EVENTS */
|
|
||||||
diff --git a/openssh-6.6p1/audit.h b/openssh-6.6p1/audit.h
|
|
||||||
--- a/openssh-6.6p1/audit.h
|
|
||||||
+++ b/openssh-6.6p1/audit.h
|
|
||||||
@@ -57,10 +57,12 @@ int audit_run_command(const char *);
|
|
||||||
void audit_end_command(int, const char *);
|
|
||||||
ssh_audit_event_t audit_classify_auth(const char *);
|
|
||||||
int audit_keyusage(int, const char *, unsigned, char *, int);
|
|
||||||
void audit_key(int, int *, const Key *);
|
|
||||||
void audit_unsupported(int);
|
|
||||||
void audit_kex(int, char *, char *, char *);
|
|
||||||
void audit_unsupported_body(int);
|
|
||||||
void audit_kex_body(int, char *, char *, char *, pid_t, uid_t);
|
|
||||||
+void audit_session_key_free(int ctos);
|
|
||||||
+void audit_session_key_free_body(int ctos, pid_t, uid_t);
|
|
||||||
|
|
||||||
#endif /* _SSH_AUDIT_H */
|
|
||||||
diff --git a/openssh-6.6p1/auditstub.c b/openssh-6.6p1/auditstub.c
|
|
||||||
--- a/openssh-6.6p1/auditstub.c
|
|
||||||
+++ b/openssh-6.6p1/auditstub.c
|
|
||||||
@@ -22,18 +22,29 @@
|
|
||||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
||||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
|
||||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
|
||||||
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
||||||
*
|
|
||||||
* Red Hat author: Jan F. Chadima <jchadima@redhat.com>
|
|
||||||
*/
|
|
||||||
|
|
||||||
+#include <sys/types.h>
|
|
||||||
+
|
|
||||||
void
|
|
||||||
audit_unsupported(int n)
|
|
||||||
{
|
|
||||||
}
|
|
||||||
|
|
||||||
void
|
|
||||||
audit_kex(int ctos, char *enc, char *mac, char *comp)
|
|
||||||
{
|
|
||||||
}
|
|
||||||
|
|
||||||
+void
|
|
||||||
+audit_session_key_free(int ctos)
|
|
||||||
+{
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+void
|
|
||||||
+audit_session_key_free_body(int ctos, pid_t pid, uid_t uid)
|
|
||||||
+{
|
|
||||||
+}
|
|
||||||
diff --git a/openssh-6.6p1/kex.c b/openssh-6.6p1/kex.c
|
|
||||||
--- a/openssh-6.6p1/kex.c
|
|
||||||
+++ b/openssh-6.6p1/kex.c
|
|
||||||
@@ -700,8 +700,39 @@ dump_digest(char *msg, u_char *digest, i
|
|
||||||
if (i%32 == 31)
|
|
||||||
fprintf(stderr, "\n");
|
|
||||||
else if (i%8 == 7)
|
|
||||||
fprintf(stderr, " ");
|
|
||||||
}
|
|
||||||
fprintf(stderr, "\n");
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
+
|
|
||||||
+static void
|
|
||||||
+enc_destroy(Enc *enc)
|
|
||||||
+{
|
|
||||||
+ if (enc == NULL)
|
|
||||||
+ return;
|
|
||||||
+
|
|
||||||
+ if (enc->key) {
|
|
||||||
+ memset(enc->key, 0, enc->key_len);
|
|
||||||
+ free(enc->key);
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ if (enc->iv) {
|
|
||||||
+ memset(enc->iv, 0, enc->block_size);
|
|
||||||
+ free(enc->iv);
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ memset(enc, 0, sizeof(*enc));
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+void
|
|
||||||
+newkeys_destroy(Newkeys *newkeys)
|
|
||||||
+{
|
|
||||||
+ if (newkeys == NULL)
|
|
||||||
+ return;
|
|
||||||
+
|
|
||||||
+ enc_destroy(&newkeys->enc);
|
|
||||||
+ mac_destroy(&newkeys->mac);
|
|
||||||
+ memset(&newkeys->comp, 0, sizeof(newkeys->comp));
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
diff --git a/openssh-6.6p1/kex.h b/openssh-6.6p1/kex.h
|
|
||||||
--- a/openssh-6.6p1/kex.h
|
|
||||||
+++ b/openssh-6.6p1/kex.h
|
|
||||||
@@ -162,16 +162,18 @@ void kexdh_client(Kex *);
|
|
||||||
void kexdh_server(Kex *);
|
|
||||||
void kexgex_client(Kex *);
|
|
||||||
void kexgex_server(Kex *);
|
|
||||||
void kexecdh_client(Kex *);
|
|
||||||
void kexecdh_server(Kex *);
|
|
||||||
void kexc25519_client(Kex *);
|
|
||||||
void kexc25519_server(Kex *);
|
|
||||||
|
|
||||||
+void newkeys_destroy(Newkeys *newkeys);
|
|
||||||
+
|
|
||||||
void
|
|
||||||
kex_dh_hash(char *, char *, char *, int, char *, int, u_char *, int,
|
|
||||||
BIGNUM *, BIGNUM *, BIGNUM *, u_char **, u_int *);
|
|
||||||
void
|
|
||||||
kexgex_hash(int, char *, char *, char *, int, char *,
|
|
||||||
int, u_char *, int, int, int, int, BIGNUM *, BIGNUM *, BIGNUM *,
|
|
||||||
BIGNUM *, BIGNUM *, u_char **, u_int *);
|
|
||||||
#ifdef OPENSSL_HAS_ECC
|
|
||||||
diff --git a/openssh-6.6p1/mac.c b/openssh-6.6p1/mac.c
|
|
||||||
--- a/openssh-6.6p1/mac.c
|
|
||||||
+++ b/openssh-6.6p1/mac.c
|
|
||||||
@@ -253,16 +253,30 @@ mac_clear(Mac *mac)
|
|
||||||
if (mac->umac_ctx != NULL)
|
|
||||||
umac128_delete(mac->umac_ctx);
|
|
||||||
} else if (mac->hmac_ctx != NULL)
|
|
||||||
ssh_hmac_free(mac->hmac_ctx);
|
|
||||||
mac->hmac_ctx = NULL;
|
|
||||||
mac->umac_ctx = NULL;
|
|
||||||
}
|
|
||||||
|
|
||||||
+void
|
|
||||||
+mac_destroy(Mac *mac)
|
|
||||||
+{
|
|
||||||
+ if (mac == NULL)
|
|
||||||
+ return;
|
|
||||||
+
|
|
||||||
+ if (mac->key) {
|
|
||||||
+ memset(mac->key, 0, mac->key_len);
|
|
||||||
+ free(mac->key);
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ memset(mac, 0, sizeof(*mac));
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
/* XXX copied from ciphers_valid */
|
|
||||||
#define MAC_SEP ","
|
|
||||||
int
|
|
||||||
mac_valid(const char *names)
|
|
||||||
{
|
|
||||||
char *maclist, *cp, *p;
|
|
||||||
|
|
||||||
if (names == NULL || strcmp(names, "") == 0)
|
|
||||||
diff --git a/openssh-6.6p1/mac.h b/openssh-6.6p1/mac.h
|
|
||||||
--- a/openssh-6.6p1/mac.h
|
|
||||||
+++ b/openssh-6.6p1/mac.h
|
|
||||||
@@ -24,8 +24,9 @@
|
|
||||||
*/
|
|
||||||
|
|
||||||
int mac_valid(const char *);
|
|
||||||
char *mac_alg_list(char);
|
|
||||||
int mac_setup(Mac *, char *);
|
|
||||||
int mac_init(Mac *);
|
|
||||||
u_char *mac_compute(Mac *, u_int32_t, u_char *, int);
|
|
||||||
void mac_clear(Mac *);
|
|
||||||
+void mac_destroy(Mac *);
|
|
||||||
diff --git a/openssh-6.6p1/monitor.c b/openssh-6.6p1/monitor.c
|
|
||||||
--- a/openssh-6.6p1/monitor.c
|
|
||||||
+++ b/openssh-6.6p1/monitor.c
|
|
||||||
@@ -179,16 +179,17 @@ int mm_answer_gss_checkmic(int, Buffer *
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#ifdef SSH_AUDIT_EVENTS
|
|
||||||
int mm_answer_audit_event(int, Buffer *);
|
|
||||||
int mm_answer_audit_command(int, Buffer *);
|
|
||||||
int mm_answer_audit_end_command(int, Buffer *);
|
|
||||||
int mm_answer_audit_unsupported_body(int, Buffer *);
|
|
||||||
int mm_answer_audit_kex_body(int, Buffer *);
|
|
||||||
+int mm_answer_audit_session_key_free_body(int, Buffer *);
|
|
||||||
#endif
|
|
||||||
|
|
||||||
static int monitor_read_log(struct monitor *);
|
|
||||||
|
|
||||||
static Authctxt *authctxt;
|
|
||||||
static BIGNUM *ssh1_challenge = NULL; /* used for ssh1 rsa auth */
|
|
||||||
|
|
||||||
/* local state for key verify */
|
|
||||||
@@ -232,16 +233,17 @@ struct mon_table mon_dispatch_proto20[]
|
|
||||||
{MONITOR_REQ_PAM_QUERY, MON_ISAUTH, mm_answer_pam_query},
|
|
||||||
{MONITOR_REQ_PAM_RESPOND, MON_ISAUTH, mm_answer_pam_respond},
|
|
||||||
{MONITOR_REQ_PAM_FREE_CTX, MON_ONCE|MON_AUTHDECIDE, mm_answer_pam_free_ctx},
|
|
||||||
#endif
|
|
||||||
#ifdef SSH_AUDIT_EVENTS
|
|
||||||
{MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
|
|
||||||
{MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},
|
|
||||||
{MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},
|
|
||||||
+ {MONITOR_REQ_AUDIT_SESSION_KEY_FREE, MON_PERMIT, mm_answer_audit_session_key_free_body},
|
|
||||||
#endif
|
|
||||||
#ifdef BSD_AUTH
|
|
||||||
{MONITOR_REQ_BSDAUTHQUERY, MON_ISAUTH, mm_answer_bsdauthquery},
|
|
||||||
{MONITOR_REQ_BSDAUTHRESPOND, MON_AUTH, mm_answer_bsdauthrespond},
|
|
||||||
#endif
|
|
||||||
#ifdef SKEY
|
|
||||||
{MONITOR_REQ_SKEYQUERY, MON_ISAUTH, mm_answer_skeyquery},
|
|
||||||
{MONITOR_REQ_SKEYRESPOND, MON_AUTH, mm_answer_skeyrespond},
|
|
||||||
@@ -264,16 +266,17 @@ struct mon_table mon_dispatch_postauth20
|
|
||||||
{MONITOR_REQ_PTYCLEANUP, 0, mm_answer_pty_cleanup},
|
|
||||||
{MONITOR_REQ_TERM, 0, mm_answer_term},
|
|
||||||
#ifdef SSH_AUDIT_EVENTS
|
|
||||||
{MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
|
|
||||||
{MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT, mm_answer_audit_command},
|
|
||||||
{MONITOR_REQ_AUDIT_END_COMMAND, MON_PERMIT, mm_answer_audit_end_command},
|
|
||||||
{MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},
|
|
||||||
{MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},
|
|
||||||
+ {MONITOR_REQ_AUDIT_SESSION_KEY_FREE, MON_PERMIT, mm_answer_audit_session_key_free_body},
|
|
||||||
#endif
|
|
||||||
{0, 0, NULL}
|
|
||||||
};
|
|
||||||
|
|
||||||
struct mon_table mon_dispatch_proto15[] = {
|
|
||||||
{MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow},
|
|
||||||
{MONITOR_REQ_SESSKEY, MON_ONCE, mm_answer_sesskey},
|
|
||||||
{MONITOR_REQ_SESSID, MON_ONCE, mm_answer_sessid},
|
|
||||||
@@ -297,30 +300,32 @@ struct mon_table mon_dispatch_proto15[]
|
|
||||||
{MONITOR_REQ_PAM_QUERY, MON_ISAUTH, mm_answer_pam_query},
|
|
||||||
{MONITOR_REQ_PAM_RESPOND, MON_ISAUTH, mm_answer_pam_respond},
|
|
||||||
{MONITOR_REQ_PAM_FREE_CTX, MON_ONCE|MON_AUTHDECIDE, mm_answer_pam_free_ctx},
|
|
||||||
#endif
|
|
||||||
#ifdef SSH_AUDIT_EVENTS
|
|
||||||
{MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
|
|
||||||
{MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},
|
|
||||||
{MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},
|
|
||||||
+ {MONITOR_REQ_AUDIT_SESSION_KEY_FREE, MON_PERMIT, mm_answer_audit_session_key_free_body},
|
|
||||||
#endif
|
|
||||||
{0, 0, NULL}
|
|
||||||
};
|
|
||||||
|
|
||||||
struct mon_table mon_dispatch_postauth15[] = {
|
|
||||||
{MONITOR_REQ_PTY, MON_ONCE, mm_answer_pty},
|
|
||||||
{MONITOR_REQ_PTYCLEANUP, MON_ONCE, mm_answer_pty_cleanup},
|
|
||||||
{MONITOR_REQ_TERM, 0, mm_answer_term},
|
|
||||||
#ifdef SSH_AUDIT_EVENTS
|
|
||||||
{MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
|
|
||||||
{MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT|MON_ONCE, mm_answer_audit_command},
|
|
||||||
{MONITOR_REQ_AUDIT_END_COMMAND, MON_PERMIT, mm_answer_audit_end_command},
|
|
||||||
{MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},
|
|
||||||
{MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},
|
|
||||||
+ {MONITOR_REQ_AUDIT_SESSION_KEY_FREE, MON_PERMIT, mm_answer_audit_session_key_free_body},
|
|
||||||
#endif
|
|
||||||
{0, 0, NULL}
|
|
||||||
};
|
|
||||||
|
|
||||||
struct mon_table *mon_dispatch;
|
|
||||||
|
|
||||||
/* Specifies if a certain message is allowed at the moment */
|
|
||||||
|
|
||||||
@@ -1949,21 +1954,23 @@ mm_get_keystate(struct monitor *pmonitor
|
|
||||||
goto skip;
|
|
||||||
} else {
|
|
||||||
/* Get the Kex for rekeying */
|
|
||||||
*pmonitor->m_pkex = mm_get_kex(&m);
|
|
||||||
}
|
|
||||||
|
|
||||||
blob = buffer_get_string(&m, &bloblen);
|
|
||||||
current_keys[MODE_OUT] = mm_newkeys_from_blob(blob, bloblen);
|
|
||||||
+ memset(blob, 0, bloblen);
|
|
||||||
free(blob);
|
|
||||||
|
|
||||||
debug3("%s: Waiting for second key", __func__);
|
|
||||||
blob = buffer_get_string(&m, &bloblen);
|
|
||||||
current_keys[MODE_IN] = mm_newkeys_from_blob(blob, bloblen);
|
|
||||||
+ memset(blob, 0, bloblen);
|
|
||||||
free(blob);
|
|
||||||
|
|
||||||
/* Now get sequence numbers for the packets */
|
|
||||||
seqnr = buffer_get_int(&m);
|
|
||||||
blocks = buffer_get_int64(&m);
|
|
||||||
packets = buffer_get_int(&m);
|
|
||||||
bytes = buffer_get_int64(&m);
|
|
||||||
packet_set_state(MODE_OUT, seqnr, blocks, packets, bytes);
|
|
||||||
@@ -1999,16 +2006,31 @@ mm_get_keystate(struct monitor *pmonitor
|
|
||||||
|
|
||||||
/* Roaming */
|
|
||||||
if (compat20) {
|
|
||||||
child_state.sent_bytes = buffer_get_int64(&m);
|
|
||||||
child_state.recv_bytes = buffer_get_int64(&m);
|
|
||||||
}
|
|
||||||
|
|
||||||
buffer_free(&m);
|
|
||||||
+
|
|
||||||
+#ifdef SSH_AUDIT_EVENTS
|
|
||||||
+ if (compat20) {
|
|
||||||
+ buffer_init(&m);
|
|
||||||
+ mm_request_receive_expect(pmonitor->m_sendfd,
|
|
||||||
+ MONITOR_REQ_AUDIT_SESSION_KEY_FREE, &m);
|
|
||||||
+ mm_answer_audit_session_key_free_body(pmonitor->m_sendfd, &m);
|
|
||||||
+ buffer_free(&m);
|
|
||||||
+ }
|
|
||||||
+#endif
|
|
||||||
+
|
|
||||||
+ /* Drain any buffered messages from the child */
|
|
||||||
+ while (pmonitor->m_log_recvfd >= 0 && monitor_read_log(pmonitor) == 0)
|
|
||||||
+ ;
|
|
||||||
+
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
/* Allocation functions for zlib */
|
|
||||||
void *
|
|
||||||
mm_zalloc(struct mm_master *mm, u_int ncount, u_int size)
|
|
||||||
{
|
|
||||||
size_t len = (size_t) size * ncount;
|
|
||||||
@@ -2240,10 +2262,28 @@ mm_answer_audit_kex_body(int sock, Buffe
|
|
||||||
free(mac);
|
|
||||||
free(compress);
|
|
||||||
buffer_clear(m);
|
|
||||||
|
|
||||||
mm_request_send(sock, MONITOR_ANS_AUDIT_KEX, m);
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
+int
|
|
||||||
+mm_answer_audit_session_key_free_body(int sock, Buffer *m)
|
|
||||||
+{
|
|
||||||
+ int ctos;
|
|
||||||
+ pid_t pid;
|
|
||||||
+ uid_t uid;
|
|
||||||
+
|
|
||||||
+ ctos = buffer_get_int(m);
|
|
||||||
+ pid = buffer_get_int64(m);
|
|
||||||
+ uid = buffer_get_int64(m);
|
|
||||||
+
|
|
||||||
+ audit_session_key_free_body(ctos, pid, uid);
|
|
||||||
+
|
|
||||||
+ buffer_clear(m);
|
|
||||||
+
|
|
||||||
+ mm_request_send(sock, MONITOR_ANS_AUDIT_SESSION_KEY_FREE, m);
|
|
||||||
+ return 0;
|
|
||||||
+}
|
|
||||||
#endif /* SSH_AUDIT_EVENTS */
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/monitor.h b/openssh-6.6p1/monitor.h
|
|
||||||
--- a/openssh-6.6p1/monitor.h
|
|
||||||
+++ b/openssh-6.6p1/monitor.h
|
|
||||||
@@ -62,16 +62,17 @@ enum monitor_reqtype {
|
|
||||||
MONITOR_REQ_PAM_INIT_CTX = 104, MONITOR_ANS_PAM_INIT_CTX = 105,
|
|
||||||
MONITOR_REQ_PAM_QUERY = 106, MONITOR_ANS_PAM_QUERY = 107,
|
|
||||||
MONITOR_REQ_PAM_RESPOND = 108, MONITOR_ANS_PAM_RESPOND = 109,
|
|
||||||
MONITOR_REQ_PAM_FREE_CTX = 110, MONITOR_ANS_PAM_FREE_CTX = 111,
|
|
||||||
MONITOR_REQ_AUDIT_EVENT = 112, MONITOR_REQ_AUDIT_COMMAND = 113,
|
|
||||||
MONITOR_ANS_AUDIT_COMMAND = 114, MONITOR_REQ_AUDIT_END_COMMAND = 115,
|
|
||||||
MONITOR_REQ_AUDIT_UNSUPPORTED = 116, MONITOR_ANS_AUDIT_UNSUPPORTED = 117,
|
|
||||||
MONITOR_REQ_AUDIT_KEX = 118, MONITOR_ANS_AUDIT_KEX = 119,
|
|
||||||
+ MONITOR_REQ_AUDIT_SESSION_KEY_FREE = 120, MONITOR_ANS_AUDIT_SESSION_KEY_FREE = 121,
|
|
||||||
|
|
||||||
};
|
|
||||||
|
|
||||||
struct mm_master;
|
|
||||||
struct monitor {
|
|
||||||
int m_recvfd;
|
|
||||||
int m_sendfd;
|
|
||||||
int m_log_recvfd;
|
|
||||||
diff --git a/openssh-6.6p1/monitor_wrap.c b/openssh-6.6p1/monitor_wrap.c
|
|
||||||
--- a/openssh-6.6p1/monitor_wrap.c
|
|
||||||
+++ b/openssh-6.6p1/monitor_wrap.c
|
|
||||||
@@ -649,22 +649,24 @@ mm_send_keystate(struct monitor *monitor
|
|
||||||
__func__, packet_get_newkeys(MODE_OUT),
|
|
||||||
packet_get_newkeys(MODE_IN));
|
|
||||||
|
|
||||||
/* Keys from Kex */
|
|
||||||
if (!mm_newkeys_to_blob(MODE_OUT, &blob, &bloblen))
|
|
||||||
fatal("%s: conversion of newkeys failed", __func__);
|
|
||||||
|
|
||||||
buffer_put_string(&m, blob, bloblen);
|
|
||||||
+ memset(blob, 0, bloblen);
|
|
||||||
free(blob);
|
|
||||||
|
|
||||||
if (!mm_newkeys_to_blob(MODE_IN, &blob, &bloblen))
|
|
||||||
fatal("%s: conversion of newkeys failed", __func__);
|
|
||||||
|
|
||||||
buffer_put_string(&m, blob, bloblen);
|
|
||||||
+ memset(blob, 0, bloblen);
|
|
||||||
free(blob);
|
|
||||||
|
|
||||||
packet_get_state(MODE_OUT, &seqnr, &blocks, &packets, &bytes);
|
|
||||||
buffer_put_int(&m, seqnr);
|
|
||||||
buffer_put_int64(&m, blocks);
|
|
||||||
buffer_put_int(&m, packets);
|
|
||||||
buffer_put_int64(&m, bytes);
|
|
||||||
packet_get_state(MODE_IN, &seqnr, &blocks, &packets, &bytes);
|
|
||||||
@@ -1356,10 +1358,25 @@ mm_audit_kex_body(int ctos, char *cipher
|
|
||||||
buffer_put_int64(&m, uid);
|
|
||||||
|
|
||||||
mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_KEX, &m);
|
|
||||||
mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_AUDIT_KEX,
|
|
||||||
&m);
|
|
||||||
|
|
||||||
buffer_free(&m);
|
|
||||||
}
|
|
||||||
+
|
|
||||||
+void
|
|
||||||
+mm_audit_session_key_free_body(int ctos, pid_t pid, uid_t uid)
|
|
||||||
+{
|
|
||||||
+ Buffer m;
|
|
||||||
+
|
|
||||||
+ buffer_init(&m);
|
|
||||||
+ buffer_put_int(&m, ctos);
|
|
||||||
+ buffer_put_int64(&m, pid);
|
|
||||||
+ buffer_put_int64(&m, uid);
|
|
||||||
+ mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_SESSION_KEY_FREE, &m);
|
|
||||||
+ mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_AUDIT_SESSION_KEY_FREE,
|
|
||||||
+ &m);
|
|
||||||
+ buffer_free(&m);
|
|
||||||
+}
|
|
||||||
#endif /* SSH_AUDIT_EVENTS */
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/monitor_wrap.h b/openssh-6.6p1/monitor_wrap.h
|
|
||||||
--- a/openssh-6.6p1/monitor_wrap.h
|
|
||||||
+++ b/openssh-6.6p1/monitor_wrap.h
|
|
||||||
@@ -74,16 +74,17 @@ void mm_sshpam_free_ctx(void *);
|
|
||||||
|
|
||||||
#ifdef SSH_AUDIT_EVENTS
|
|
||||||
#include "audit.h"
|
|
||||||
void mm_audit_event(ssh_audit_event_t);
|
|
||||||
int mm_audit_run_command(const char *);
|
|
||||||
void mm_audit_end_command(int, const char *);
|
|
||||||
void mm_audit_unsupported_body(int);
|
|
||||||
void mm_audit_kex_body(int, char *, char *, char *, pid_t, uid_t);
|
|
||||||
+void mm_audit_session_key_free_body(int, pid_t, uid_t);
|
|
||||||
#endif
|
|
||||||
|
|
||||||
struct Session;
|
|
||||||
void mm_terminate(void);
|
|
||||||
int mm_pty_allocate(int *, int *, char *, size_t);
|
|
||||||
void mm_session_pty_cleanup2(struct Session *);
|
|
||||||
|
|
||||||
/* SSHv1 interfaces */
|
|
||||||
diff --git a/openssh-6.6p1/packet.c b/openssh-6.6p1/packet.c
|
|
||||||
--- a/openssh-6.6p1/packet.c
|
|
||||||
+++ b/openssh-6.6p1/packet.c
|
|
||||||
@@ -56,16 +56,17 @@
|
|
||||||
#include <stdio.h>
|
|
||||||
#include <stdlib.h>
|
|
||||||
#include <string.h>
|
|
||||||
#include <unistd.h>
|
|
||||||
#include <signal.h>
|
|
||||||
#include <time.h>
|
|
||||||
|
|
||||||
#include "xmalloc.h"
|
|
||||||
+#include "audit.h"
|
|
||||||
#include "buffer.h"
|
|
||||||
#include "packet.h"
|
|
||||||
#include "crc32.h"
|
|
||||||
#include "compress.h"
|
|
||||||
#include "deattack.h"
|
|
||||||
#include "channels.h"
|
|
||||||
#include "compat.h"
|
|
||||||
#include "ssh1.h"
|
|
||||||
@@ -469,41 +470,51 @@ packet_get_connection_in(void)
|
|
||||||
/* Returns the descriptor used for writing. */
|
|
||||||
|
|
||||||
int
|
|
||||||
packet_get_connection_out(void)
|
|
||||||
{
|
|
||||||
return active_state->connection_out;
|
|
||||||
}
|
|
||||||
|
|
||||||
+static int
|
|
||||||
+packet_state_has_keys (const struct session_state *state)
|
|
||||||
+{
|
|
||||||
+ return state != NULL &&
|
|
||||||
+ (state->newkeys[MODE_IN] != NULL || state->newkeys[MODE_OUT] != NULL);
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
/* Closes the connection and clears and frees internal data structures. */
|
|
||||||
|
|
||||||
void
|
|
||||||
packet_close(void)
|
|
||||||
{
|
|
||||||
if (!active_state->initialized)
|
|
||||||
return;
|
|
||||||
active_state->initialized = 0;
|
|
||||||
- if (active_state->connection_in == active_state->connection_out) {
|
|
||||||
- shutdown(active_state->connection_out, SHUT_RDWR);
|
|
||||||
- close(active_state->connection_out);
|
|
||||||
- } else {
|
|
||||||
- close(active_state->connection_in);
|
|
||||||
- close(active_state->connection_out);
|
|
||||||
- }
|
|
||||||
buffer_free(&active_state->input);
|
|
||||||
buffer_free(&active_state->output);
|
|
||||||
buffer_free(&active_state->outgoing_packet);
|
|
||||||
buffer_free(&active_state->incoming_packet);
|
|
||||||
if (active_state->compression_buffer_ready) {
|
|
||||||
buffer_free(&active_state->compression_buffer);
|
|
||||||
buffer_compress_uninit();
|
|
||||||
}
|
|
||||||
- cipher_cleanup(&active_state->send_context);
|
|
||||||
- cipher_cleanup(&active_state->receive_context);
|
|
||||||
+ if (packet_state_has_keys(active_state)) {
|
|
||||||
+ cipher_cleanup(&active_state->send_context);
|
|
||||||
+ cipher_cleanup(&active_state->receive_context);
|
|
||||||
+ audit_session_key_free(2);
|
|
||||||
+ }
|
|
||||||
+ if (active_state->connection_in == active_state->connection_out) {
|
|
||||||
+ shutdown(active_state->connection_out, SHUT_RDWR);
|
|
||||||
+ close(active_state->connection_out);
|
|
||||||
+ } else {
|
|
||||||
+ close(active_state->connection_in);
|
|
||||||
+ close(active_state->connection_out);
|
|
||||||
+ }
|
|
||||||
}
|
|
||||||
|
|
||||||
/* Sets remote side protocol flags. */
|
|
||||||
|
|
||||||
void
|
|
||||||
packet_set_protocol_flags(u_int protocol_flags)
|
|
||||||
{
|
|
||||||
active_state->remote_protocol_flags = protocol_flags;
|
|
||||||
@@ -729,16 +740,35 @@ packet_send1(void)
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Note that the packet is now only buffered in output. It won't be
|
|
||||||
* actually sent until packet_write_wait or packet_write_poll is
|
|
||||||
* called.
|
|
||||||
*/
|
|
||||||
}
|
|
||||||
|
|
||||||
+static void
|
|
||||||
+newkeys_destroy_and_free(Newkeys *newkeys)
|
|
||||||
+{
|
|
||||||
+ if (newkeys == NULL)
|
|
||||||
+ return;
|
|
||||||
+
|
|
||||||
+ free(newkeys->enc.name);
|
|
||||||
+
|
|
||||||
+ mac_clear(&newkeys->mac);
|
|
||||||
+ /* MAC may happen to be empty - if the GCM mode of AES is used */
|
|
||||||
+ if (newkeys->mac.name)
|
|
||||||
+ free(newkeys->mac.name);
|
|
||||||
+
|
|
||||||
+ free(newkeys->comp.name);
|
|
||||||
+
|
|
||||||
+ newkeys_destroy(newkeys);
|
|
||||||
+ free(newkeys);
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
void
|
|
||||||
set_newkeys(int mode)
|
|
||||||
{
|
|
||||||
Enc *enc;
|
|
||||||
Mac *mac;
|
|
||||||
Comp *comp;
|
|
||||||
CipherContext *cc;
|
|
||||||
u_int64_t *max_blocks;
|
|
||||||
@@ -754,31 +784,19 @@ set_newkeys(int mode)
|
|
||||||
} else {
|
|
||||||
cc = &active_state->receive_context;
|
|
||||||
crypt_type = CIPHER_DECRYPT;
|
|
||||||
active_state->p_read.packets = active_state->p_read.blocks = 0;
|
|
||||||
max_blocks = &active_state->max_blocks_in;
|
|
||||||
}
|
|
||||||
if (active_state->newkeys[mode] != NULL) {
|
|
||||||
debug("set_newkeys: rekeying");
|
|
||||||
+ audit_session_key_free(mode);
|
|
||||||
cipher_cleanup(cc);
|
|
||||||
- enc = &active_state->newkeys[mode]->enc;
|
|
||||||
- mac = &active_state->newkeys[mode]->mac;
|
|
||||||
- comp = &active_state->newkeys[mode]->comp;
|
|
||||||
- mac_clear(mac);
|
|
||||||
- explicit_bzero(enc->iv, enc->iv_len);
|
|
||||||
- explicit_bzero(enc->key, enc->key_len);
|
|
||||||
- explicit_bzero(mac->key, mac->key_len);
|
|
||||||
- free(enc->name);
|
|
||||||
- free(enc->iv);
|
|
||||||
- free(enc->key);
|
|
||||||
- free(mac->name);
|
|
||||||
- free(mac->key);
|
|
||||||
- free(comp->name);
|
|
||||||
- free(active_state->newkeys[mode]);
|
|
||||||
+ newkeys_destroy_and_free(active_state->newkeys[mode]);
|
|
||||||
}
|
|
||||||
active_state->newkeys[mode] = kex_get_newkeys(mode);
|
|
||||||
if (active_state->newkeys[mode] == NULL)
|
|
||||||
fatal("newkeys: no keys for mode %d", mode);
|
|
||||||
enc = &active_state->newkeys[mode]->enc;
|
|
||||||
mac = &active_state->newkeys[mode]->mac;
|
|
||||||
comp = &active_state->newkeys[mode]->comp;
|
|
||||||
if (cipher_authlen(enc->cipher) == 0 && mac_init(mac) == 0)
|
|
||||||
@@ -2004,54 +2022,93 @@ packet_get_output(void)
|
|
||||||
}
|
|
||||||
|
|
||||||
void *
|
|
||||||
packet_get_newkeys(int mode)
|
|
||||||
{
|
|
||||||
return (void *)active_state->newkeys[mode];
|
|
||||||
}
|
|
||||||
|
|
||||||
+static void
|
|
||||||
+packet_destroy_state(struct session_state *state)
|
|
||||||
+{
|
|
||||||
+ if (state == NULL)
|
|
||||||
+ return;
|
|
||||||
+
|
|
||||||
+ cipher_cleanup(&state->receive_context);
|
|
||||||
+ cipher_cleanup(&state->send_context);
|
|
||||||
+
|
|
||||||
+ buffer_free(&state->input);
|
|
||||||
+ buffer_free(&state->output);
|
|
||||||
+ buffer_free(&state->outgoing_packet);
|
|
||||||
+ buffer_free(&state->incoming_packet);
|
|
||||||
+ buffer_free(&state->compression_buffer);
|
|
||||||
+ newkeys_destroy_and_free(state->newkeys[MODE_IN]);
|
|
||||||
+ state->newkeys[MODE_IN] = NULL;
|
|
||||||
+ newkeys_destroy_and_free(state->newkeys[MODE_OUT]);
|
|
||||||
+ state->newkeys[MODE_OUT] = NULL;
|
|
||||||
+ mac_destroy(state->packet_discard_mac);
|
|
||||||
+// TAILQ_HEAD(, packet) outgoing;
|
|
||||||
+// memset(state, 0, sizeof(state));
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+void
|
|
||||||
+packet_destroy_all(int audit_it, int privsep)
|
|
||||||
+{
|
|
||||||
+ if (audit_it)
|
|
||||||
+ audit_it = packet_state_has_keys (active_state) ||
|
|
||||||
+ packet_state_has_keys (backup_state);
|
|
||||||
+ packet_destroy_state(active_state);
|
|
||||||
+ packet_destroy_state(backup_state);
|
|
||||||
+ if (audit_it) {
|
|
||||||
+#ifdef SSH_AUDIT_EVENTS
|
|
||||||
+ if (privsep)
|
|
||||||
+ audit_session_key_free(2);
|
|
||||||
+ else
|
|
||||||
+ audit_session_key_free_body(2, getpid(), getuid());
|
|
||||||
+#endif
|
|
||||||
+ }
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
/*
|
|
||||||
* Save the state for the real connection, and use a separate state when
|
|
||||||
* resuming a suspended connection.
|
|
||||||
*/
|
|
||||||
void
|
|
||||||
packet_backup_state(void)
|
|
||||||
{
|
|
||||||
- struct session_state *tmp;
|
|
||||||
-
|
|
||||||
close(active_state->connection_in);
|
|
||||||
active_state->connection_in = -1;
|
|
||||||
close(active_state->connection_out);
|
|
||||||
active_state->connection_out = -1;
|
|
||||||
- if (backup_state)
|
|
||||||
- tmp = backup_state;
|
|
||||||
- else
|
|
||||||
- tmp = alloc_session_state();
|
|
||||||
backup_state = active_state;
|
|
||||||
- active_state = tmp;
|
|
||||||
+ active_state = alloc_session_state();
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Swap in the old state when resuming a connecion.
|
|
||||||
*/
|
|
||||||
void
|
|
||||||
packet_restore_state(void)
|
|
||||||
{
|
|
||||||
struct session_state *tmp;
|
|
||||||
void *buf;
|
|
||||||
u_int len;
|
|
||||||
|
|
||||||
tmp = backup_state;
|
|
||||||
backup_state = active_state;
|
|
||||||
active_state = tmp;
|
|
||||||
active_state->connection_in = backup_state->connection_in;
|
|
||||||
- backup_state->connection_in = -1;
|
|
||||||
active_state->connection_out = backup_state->connection_out;
|
|
||||||
- backup_state->connection_out = -1;
|
|
||||||
len = buffer_len(&backup_state->input);
|
|
||||||
if (len > 0) {
|
|
||||||
buf = buffer_ptr(&backup_state->input);
|
|
||||||
buffer_append(&active_state->input, buf, len);
|
|
||||||
buffer_clear(&backup_state->input);
|
|
||||||
add_recv_bytes(len);
|
|
||||||
}
|
|
||||||
+ backup_state->connection_in = -1;
|
|
||||||
+ backup_state->connection_out = -1;
|
|
||||||
+ packet_destroy_state(backup_state);
|
|
||||||
+ free(backup_state);
|
|
||||||
+ backup_state = NULL;
|
|
||||||
}
|
|
||||||
+
|
|
||||||
diff --git a/openssh-6.6p1/packet.h b/openssh-6.6p1/packet.h
|
|
||||||
--- a/openssh-6.6p1/packet.h
|
|
||||||
+++ b/openssh-6.6p1/packet.h
|
|
||||||
@@ -119,9 +119,10 @@ void packet_set_rekey_limits(u_int32_t,
|
|
||||||
time_t packet_get_rekey_timeout(void);
|
|
||||||
|
|
||||||
void packet_backup_state(void);
|
|
||||||
void packet_restore_state(void);
|
|
||||||
|
|
||||||
void *packet_get_input(void);
|
|
||||||
void *packet_get_output(void);
|
|
||||||
|
|
||||||
+void packet_destroy_all(int, int);
|
|
||||||
#endif /* PACKET_H */
|
|
||||||
diff --git a/openssh-6.6p1/session.c b/openssh-6.6p1/session.c
|
|
||||||
--- a/openssh-6.6p1/session.c
|
|
||||||
+++ b/openssh-6.6p1/session.c
|
|
||||||
@@ -1694,16 +1694,19 @@ do_child(Session *s, const char *command
|
|
||||||
int env_size;
|
|
||||||
char *argv[ARGV_MAX];
|
|
||||||
const char *shell, *shell0, *hostname = NULL;
|
|
||||||
struct passwd *pw = s->pw;
|
|
||||||
int r = 0;
|
|
||||||
|
|
||||||
/* remove hostkey from the child's memory */
|
|
||||||
destroy_sensitive_data();
|
|
||||||
+ /* Don't audit this - both us and the parent would be talking to the
|
|
||||||
+ monitor over a single socket, with no synchronization. */
|
|
||||||
+ packet_destroy_all(0, 1);
|
|
||||||
|
|
||||||
/* Force a password change */
|
|
||||||
if (s->authctxt->force_pwchange) {
|
|
||||||
do_setusercontext(pw);
|
|
||||||
child_close_fds();
|
|
||||||
do_pwchange(s);
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
diff --git a/openssh-6.6p1/sshd.c b/openssh-6.6p1/sshd.c
|
|
||||||
--- a/openssh-6.6p1/sshd.c
|
|
||||||
+++ b/openssh-6.6p1/sshd.c
|
|
||||||
@@ -720,16 +720,18 @@ privsep_preauth(Authctxt *authctxt)
|
|
||||||
setproctitle("%s", "[net]");
|
|
||||||
if (box != NULL)
|
|
||||||
ssh_sandbox_child(box);
|
|
||||||
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
+extern Newkeys *current_keys[];
|
|
||||||
+
|
|
||||||
static void
|
|
||||||
privsep_postauth(Authctxt *authctxt)
|
|
||||||
{
|
|
||||||
u_int32_t rnd[256];
|
|
||||||
|
|
||||||
#ifdef DISABLE_FD_PASSING
|
|
||||||
if (1) {
|
|
||||||
#else
|
|
||||||
@@ -744,16 +746,20 @@ privsep_postauth(Authctxt *authctxt)
|
|
||||||
monitor_reinit(pmonitor);
|
|
||||||
|
|
||||||
pmonitor->m_pid = fork();
|
|
||||||
if (pmonitor->m_pid == -1)
|
|
||||||
fatal("fork of unprivileged child failed");
|
|
||||||
else if (pmonitor->m_pid != 0) {
|
|
||||||
verbose("User child is on pid %ld", (long)pmonitor->m_pid);
|
|
||||||
buffer_clear(&loginmsg);
|
|
||||||
+ newkeys_destroy(current_keys[MODE_OUT]);
|
|
||||||
+ newkeys_destroy(current_keys[MODE_IN]);
|
|
||||||
+ audit_session_key_free_body(2, getpid(), getuid());
|
|
||||||
+ packet_destroy_all(0, 0);
|
|
||||||
monitor_child_postauth(pmonitor);
|
|
||||||
|
|
||||||
/* NEVERREACHED */
|
|
||||||
exit(0);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* child */
|
|
||||||
|
|
||||||
@@ -2118,16 +2124,17 @@ main(int ac, char **av)
|
|
||||||
do_authentication(authctxt);
|
|
||||||
}
|
|
||||||
/*
|
|
||||||
* If we use privilege separation, the unprivileged child transfers
|
|
||||||
* the current keystate and exits
|
|
||||||
*/
|
|
||||||
if (use_privsep) {
|
|
||||||
mm_send_keystate(pmonitor);
|
|
||||||
+ packet_destroy_all(1, 1);
|
|
||||||
exit(0);
|
|
||||||
}
|
|
||||||
|
|
||||||
authenticated:
|
|
||||||
/*
|
|
||||||
* Cancel the alarm we set to limit the time taken for
|
|
||||||
* authentication.
|
|
||||||
*/
|
|
||||||
@@ -2170,16 +2177,18 @@ main(int ac, char **av)
|
|
||||||
|
|
||||||
packet_set_timeout(options.client_alive_interval,
|
|
||||||
options.client_alive_count_max);
|
|
||||||
|
|
||||||
/* Start session. */
|
|
||||||
do_authenticated(authctxt);
|
|
||||||
|
|
||||||
/* The connection has been terminated. */
|
|
||||||
+ packet_destroy_all(1, 1);
|
|
||||||
+
|
|
||||||
packet_get_state(MODE_IN, NULL, NULL, NULL, &ibytes);
|
|
||||||
packet_get_state(MODE_OUT, NULL, NULL, NULL, &obytes);
|
|
||||||
verbose("Transferred: sent %llu, received %llu bytes",
|
|
||||||
(unsigned long long)obytes, (unsigned long long)ibytes);
|
|
||||||
|
|
||||||
verbose("Closing connection to %.500s port %d", remote_ip, remote_port);
|
|
||||||
|
|
||||||
#ifdef USE_PAM
|
|
||||||
@@ -2526,26 +2535,38 @@ do_ssh2_kex(void)
|
|
||||||
#endif
|
|
||||||
debug("KEX done");
|
|
||||||
}
|
|
||||||
|
|
||||||
/* server specific fatal cleanup */
|
|
||||||
void
|
|
||||||
cleanup_exit(int i)
|
|
||||||
{
|
|
||||||
+ static int in_cleanup = 0;
|
|
||||||
+ int is_privsep_child;
|
|
||||||
+
|
|
||||||
+ /* cleanup_exit can be called at the very least from the privsep
|
|
||||||
+ wrappers used for auditing. Make sure we don't recurse
|
|
||||||
+ indefinitely. */
|
|
||||||
+ if (in_cleanup)
|
|
||||||
+ _exit(i);
|
|
||||||
+ in_cleanup = 1;
|
|
||||||
+
|
|
||||||
if (the_authctxt) {
|
|
||||||
do_cleanup(the_authctxt);
|
|
||||||
if (use_privsep && privsep_is_preauth && pmonitor->m_pid > 1) {
|
|
||||||
debug("Killing privsep child %d", pmonitor->m_pid);
|
|
||||||
if (kill(pmonitor->m_pid, SIGKILL) != 0 &&
|
|
||||||
errno != ESRCH)
|
|
||||||
error("%s: kill(%d): %s", __func__,
|
|
||||||
pmonitor->m_pid, strerror(errno));
|
|
||||||
}
|
|
||||||
}
|
|
||||||
+ is_privsep_child = use_privsep && (pmonitor != NULL) && !mm_is_monitor();
|
|
||||||
+ packet_destroy_all(1, is_privsep_child);
|
|
||||||
#ifdef SSH_AUDIT_EVENTS
|
|
||||||
/* done after do_cleanup so it can cancel the PAM auth 'thread' */
|
|
||||||
if ((the_authctxt == NULL || !the_authctxt->authenticated) &&
|
|
||||||
(!use_privsep || mm_is_monitor()))
|
|
||||||
audit_event(SSH_CONNECTION_ABANDON);
|
|
||||||
#endif
|
|
||||||
_exit(i);
|
|
||||||
}
|
|
@ -1,742 +0,0 @@
|
|||||||
# server key destruction and auditing
|
|
||||||
# based on:
|
|
||||||
# https://bugzilla.mindrot.org/show_bug.cgi?id=1402
|
|
||||||
# https://bugzilla.mindrot.org/attachment.cgi?id=2015
|
|
||||||
# by jchadima@redhat.com
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/audit-bsm.c b/openssh-6.6p1/audit-bsm.c
|
|
||||||
--- a/openssh-6.6p1/audit-bsm.c
|
|
||||||
+++ b/openssh-6.6p1/audit-bsm.c
|
|
||||||
@@ -486,9 +486,27 @@ audit_kex_body(int ctos, char *enc, char
|
|
||||||
/* not implemented */
|
|
||||||
}
|
|
||||||
|
|
||||||
void
|
|
||||||
audit_session_key_free_body(int ctos, pid_t pid, uid_t uid)
|
|
||||||
{
|
|
||||||
/* not implemented */
|
|
||||||
}
|
|
||||||
+
|
|
||||||
+void
|
|
||||||
+audit_destroy_sensitive_data(const char *fp)
|
|
||||||
+{
|
|
||||||
+ /* not implemented */
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+void
|
|
||||||
+audit_destroy_sensitive_data(const char *fp, pid_t pid, uid_t uid)
|
|
||||||
+{
|
|
||||||
+ /* not implemented */
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+void
|
|
||||||
+audit_generate_ephemeral_server_key(const char *fp)
|
|
||||||
+{
|
|
||||||
+ /* not implemented */
|
|
||||||
+}
|
|
||||||
#endif /* BSM */
|
|
||||||
diff --git a/openssh-6.6p1/audit-linux.c b/openssh-6.6p1/audit-linux.c
|
|
||||||
--- a/openssh-6.6p1/audit-linux.c
|
|
||||||
+++ b/openssh-6.6p1/audit-linux.c
|
|
||||||
@@ -351,9 +351,55 @@ audit_session_key_free_body(int ctos, pi
|
|
||||||
audit_ok = audit_log_user_message(audit_fd, AUDIT_CRYPTO_KEY_USER,
|
|
||||||
buf, NULL, get_remote_ipaddr(), NULL, 1);
|
|
||||||
audit_close(audit_fd);
|
|
||||||
/* do not abort if the error is EPERM and sshd is run as non root user */
|
|
||||||
if ((audit_ok < 0) && ((audit_ok != -1) || (getuid() == 0)))
|
|
||||||
error("cannot write into audit");
|
|
||||||
}
|
|
||||||
|
|
||||||
+void
|
|
||||||
+audit_destroy_sensitive_data(const char *fp, pid_t pid, uid_t uid)
|
|
||||||
+{
|
|
||||||
+ char buf[AUDIT_LOG_SIZE];
|
|
||||||
+ int audit_fd, audit_ok;
|
|
||||||
+
|
|
||||||
+ snprintf(buf, sizeof(buf), "op=destroy kind=server fp=%s direction=? spid=%jd suid=%jd ",
|
|
||||||
+ fp, (intmax_t)pid, (intmax_t)uid);
|
|
||||||
+ audit_fd = audit_open();
|
|
||||||
+ if (audit_fd < 0) {
|
|
||||||
+ if (errno != EINVAL && errno != EPROTONOSUPPORT &&
|
|
||||||
+ errno != EAFNOSUPPORT)
|
|
||||||
+ error("cannot open audit");
|
|
||||||
+ return;
|
|
||||||
+ }
|
|
||||||
+ audit_ok = audit_log_user_message(audit_fd, AUDIT_CRYPTO_KEY_USER,
|
|
||||||
+ buf, NULL,
|
|
||||||
+ listening_for_clients() ? NULL : get_remote_ipaddr(),
|
|
||||||
+ NULL, 1);
|
|
||||||
+ audit_close(audit_fd);
|
|
||||||
+ /* do not abort if the error is EPERM and sshd is run as non root user */
|
|
||||||
+ if ((audit_ok < 0) && ((audit_ok != -1) || (getuid() == 0)))
|
|
||||||
+ error("cannot write into audit");
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+void
|
|
||||||
+audit_generate_ephemeral_server_key(const char *fp)
|
|
||||||
+{
|
|
||||||
+ char buf[AUDIT_LOG_SIZE];
|
|
||||||
+ int audit_fd, audit_ok;
|
|
||||||
+
|
|
||||||
+ snprintf(buf, sizeof(buf), "op=create kind=server fp=%s direction=? ", fp);
|
|
||||||
+ audit_fd = audit_open();
|
|
||||||
+ if (audit_fd < 0) {
|
|
||||||
+ if (errno != EINVAL && errno != EPROTONOSUPPORT &&
|
|
||||||
+ errno != EAFNOSUPPORT)
|
|
||||||
+ error("cannot open audit");
|
|
||||||
+ return;
|
|
||||||
+ }
|
|
||||||
+ audit_ok = audit_log_user_message(audit_fd, AUDIT_CRYPTO_KEY_USER,
|
|
||||||
+ buf, NULL, 0, NULL, 1);
|
|
||||||
+ audit_close(audit_fd);
|
|
||||||
+ /* do not abort if the error is EPERM and sshd is run as non root user */
|
|
||||||
+ if ((audit_ok < 0) && ((audit_ok != -1) || (getuid() == 0)))
|
|
||||||
+ error("cannot write into audit");
|
|
||||||
+}
|
|
||||||
#endif /* USE_LINUX_AUDIT */
|
|
||||||
diff --git a/openssh-6.6p1/audit.c b/openssh-6.6p1/audit.c
|
|
||||||
--- a/openssh-6.6p1/audit.c
|
|
||||||
+++ b/openssh-6.6p1/audit.c
|
|
||||||
@@ -285,10 +285,29 @@ audit_kex_body(int ctos, char *enc, char
|
|
||||||
* This will be called on succesfull session key discard
|
|
||||||
*/
|
|
||||||
void
|
|
||||||
audit_session_key_free_body(int ctos, pid_t pid, uid_t uid)
|
|
||||||
{
|
|
||||||
debug("audit session key discard euid %u direction %d from pid %ld uid %u",
|
|
||||||
(unsigned)geteuid(), ctos, (long)pid, (unsigned)uid);
|
|
||||||
}
|
|
||||||
+
|
|
||||||
+/*
|
|
||||||
+ * This will be called on destroy private part of the server key
|
|
||||||
+ */
|
|
||||||
+void
|
|
||||||
+audit_destroy_sensitive_data(const char *fp, pid_t pid, uid_t uid)
|
|
||||||
+{
|
|
||||||
+ debug("audit destroy sensitive data euid %d fingerprint %s from pid %ld uid %u",
|
|
||||||
+ geteuid(), fp, (long)pid, (unsigned)uid);
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+/*
|
|
||||||
+ * This will be called on generation of the ephemeral server key
|
|
||||||
+ */
|
|
||||||
+void
|
|
||||||
+audit_generate_ephemeral_server_key(const char *)
|
|
||||||
+{
|
|
||||||
+ debug("audit create ephemeral server key euid %d fingerprint %s", geteuid(), fp);
|
|
||||||
+}
|
|
||||||
# endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */
|
|
||||||
#endif /* SSH_AUDIT_EVENTS */
|
|
||||||
diff --git a/openssh-6.6p1/audit.h b/openssh-6.6p1/audit.h
|
|
||||||
--- a/openssh-6.6p1/audit.h
|
|
||||||
+++ b/openssh-6.6p1/audit.h
|
|
||||||
@@ -43,26 +43,30 @@ enum ssh_audit_event_type {
|
|
||||||
SSH_INVALID_USER,
|
|
||||||
SSH_NOLOGIN, /* denied by /etc/nologin, not implemented */
|
|
||||||
SSH_CONNECTION_CLOSE, /* closed after attempting auth or session */
|
|
||||||
SSH_CONNECTION_ABANDON, /* closed without completing auth */
|
|
||||||
SSH_AUDIT_UNKNOWN
|
|
||||||
};
|
|
||||||
typedef enum ssh_audit_event_type ssh_audit_event_t;
|
|
||||||
|
|
||||||
+int listening_for_clients(void);
|
|
||||||
+
|
|
||||||
void audit_connection_from(const char *, int);
|
|
||||||
void audit_event(ssh_audit_event_t);
|
|
||||||
void audit_count_session_open(void);
|
|
||||||
void audit_session_open(struct logininfo *);
|
|
||||||
void audit_session_close(struct logininfo *);
|
|
||||||
int audit_run_command(const char *);
|
|
||||||
void audit_end_command(int, const char *);
|
|
||||||
ssh_audit_event_t audit_classify_auth(const char *);
|
|
||||||
int audit_keyusage(int, const char *, unsigned, char *, int);
|
|
||||||
void audit_key(int, int *, const Key *);
|
|
||||||
void audit_unsupported(int);
|
|
||||||
void audit_kex(int, char *, char *, char *);
|
|
||||||
void audit_unsupported_body(int);
|
|
||||||
void audit_kex_body(int, char *, char *, char *, pid_t, uid_t);
|
|
||||||
void audit_session_key_free(int ctos);
|
|
||||||
void audit_session_key_free_body(int ctos, pid_t, uid_t);
|
|
||||||
+void audit_destroy_sensitive_data(const char *, pid_t, uid_t);
|
|
||||||
+void audit_generate_ephemeral_server_key(const char *);
|
|
||||||
|
|
||||||
#endif /* _SSH_AUDIT_H */
|
|
||||||
diff --git a/openssh-6.6p1/key.c b/openssh-6.6p1/key.c
|
|
||||||
--- a/openssh-6.6p1/key.c
|
|
||||||
+++ b/openssh-6.6p1/key.c
|
|
||||||
@@ -1964,16 +1964,43 @@ key_demote(const Key *k)
|
|
||||||
fatal("key_demote: bad key type %d", k->type);
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
|
|
||||||
return (pk);
|
|
||||||
}
|
|
||||||
|
|
||||||
int
|
|
||||||
+key_is_private(const Key *k)
|
|
||||||
+{
|
|
||||||
+ switch (k->type) {
|
|
||||||
+ case KEY_RSA_CERT_V00:
|
|
||||||
+ case KEY_RSA_CERT:
|
|
||||||
+ case KEY_RSA1:
|
|
||||||
+ case KEY_RSA:
|
|
||||||
+ return k->rsa->d != NULL;
|
|
||||||
+ case KEY_DSA_CERT_V00:
|
|
||||||
+ case KEY_DSA_CERT:
|
|
||||||
+ case KEY_DSA:
|
|
||||||
+ return k->dsa->priv_key != NULL;
|
|
||||||
+#ifdef OPENSSL_HAS_ECC
|
|
||||||
+ case KEY_ECDSA_CERT:
|
|
||||||
+ case KEY_ECDSA:
|
|
||||||
+ return EC_KEY_get0_private_key(k->ecdsa) != NULL;
|
|
||||||
+#endif
|
|
||||||
+ case KEY_ED25519_CERT:
|
|
||||||
+ case KEY_ED25519:
|
|
||||||
+ return k->ed25519_sk != NULL;
|
|
||||||
+ default:
|
|
||||||
+ fatal("key_is_private: bad key type %d", k->type);
|
|
||||||
+ return 1;
|
|
||||||
+ }
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+int
|
|
||||||
key_is_cert(const Key *k)
|
|
||||||
{
|
|
||||||
if (k == NULL)
|
|
||||||
return 0;
|
|
||||||
return key_type_is_cert(k->type);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* Return the cert-less equivalent to a certified key type */
|
|
||||||
diff --git a/openssh-6.6p1/key.h b/openssh-6.6p1/key.h
|
|
||||||
--- a/openssh-6.6p1/key.h
|
|
||||||
+++ b/openssh-6.6p1/key.h
|
|
||||||
@@ -113,16 +113,17 @@ int key_read(Key *, char **);
|
|
||||||
u_int key_size(const Key *);
|
|
||||||
enum fp_type key_fp_type_select(void);
|
|
||||||
char *key_fp_type_str(enum fp_type);
|
|
||||||
|
|
||||||
Key *key_generate(int, u_int);
|
|
||||||
Key *key_from_private(const Key *);
|
|
||||||
int key_type_from_name(char *);
|
|
||||||
int key_is_cert(const Key *);
|
|
||||||
+int key_is_private(const Key *k);
|
|
||||||
int key_type_is_cert(int);
|
|
||||||
int key_type_plain(int);
|
|
||||||
int key_to_certified(Key *, int);
|
|
||||||
int key_drop_cert(Key *);
|
|
||||||
int key_certify(Key *, Key *);
|
|
||||||
void key_cert_copy(const Key *, struct Key *);
|
|
||||||
int key_cert_check_authority(const Key *, int, int, const char *,
|
|
||||||
const char **);
|
|
||||||
diff --git a/openssh-6.6p1/monitor.c b/openssh-6.6p1/monitor.c
|
|
||||||
--- a/openssh-6.6p1/monitor.c
|
|
||||||
+++ b/openssh-6.6p1/monitor.c
|
|
||||||
@@ -109,16 +109,18 @@ extern u_int utmp_len;
|
|
||||||
extern Newkeys *current_keys[];
|
|
||||||
extern z_stream incoming_stream;
|
|
||||||
extern z_stream outgoing_stream;
|
|
||||||
extern u_char session_id[];
|
|
||||||
extern Buffer auth_debug;
|
|
||||||
extern int auth_debug_init;
|
|
||||||
extern Buffer loginmsg;
|
|
||||||
|
|
||||||
+extern void destroy_sensitive_data(int);
|
|
||||||
+
|
|
||||||
/* State exported from the child */
|
|
||||||
|
|
||||||
struct {
|
|
||||||
z_stream incoming;
|
|
||||||
z_stream outgoing;
|
|
||||||
u_char *keyin;
|
|
||||||
u_int keyinlen;
|
|
||||||
u_char *keyout;
|
|
||||||
@@ -180,16 +182,17 @@ int mm_answer_gss_checkmic(int, Buffer *
|
|
||||||
|
|
||||||
#ifdef SSH_AUDIT_EVENTS
|
|
||||||
int mm_answer_audit_event(int, Buffer *);
|
|
||||||
int mm_answer_audit_command(int, Buffer *);
|
|
||||||
int mm_answer_audit_end_command(int, Buffer *);
|
|
||||||
int mm_answer_audit_unsupported_body(int, Buffer *);
|
|
||||||
int mm_answer_audit_kex_body(int, Buffer *);
|
|
||||||
int mm_answer_audit_session_key_free_body(int, Buffer *);
|
|
||||||
+int mm_answer_audit_server_key_free(int, Buffer *);
|
|
||||||
#endif
|
|
||||||
|
|
||||||
static int monitor_read_log(struct monitor *);
|
|
||||||
|
|
||||||
static Authctxt *authctxt;
|
|
||||||
static BIGNUM *ssh1_challenge = NULL; /* used for ssh1 rsa auth */
|
|
||||||
|
|
||||||
/* local state for key verify */
|
|
||||||
@@ -234,16 +237,17 @@ struct mon_table mon_dispatch_proto20[]
|
|
||||||
{MONITOR_REQ_PAM_RESPOND, MON_ISAUTH, mm_answer_pam_respond},
|
|
||||||
{MONITOR_REQ_PAM_FREE_CTX, MON_ONCE|MON_AUTHDECIDE, mm_answer_pam_free_ctx},
|
|
||||||
#endif
|
|
||||||
#ifdef SSH_AUDIT_EVENTS
|
|
||||||
{MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
|
|
||||||
{MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},
|
|
||||||
{MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},
|
|
||||||
{MONITOR_REQ_AUDIT_SESSION_KEY_FREE, MON_PERMIT, mm_answer_audit_session_key_free_body},
|
|
||||||
+ {MONITOR_REQ_AUDIT_SERVER_KEY_FREE, MON_PERMIT, mm_answer_audit_server_key_free},
|
|
||||||
#endif
|
|
||||||
#ifdef BSD_AUTH
|
|
||||||
{MONITOR_REQ_BSDAUTHQUERY, MON_ISAUTH, mm_answer_bsdauthquery},
|
|
||||||
{MONITOR_REQ_BSDAUTHRESPOND, MON_AUTH, mm_answer_bsdauthrespond},
|
|
||||||
#endif
|
|
||||||
#ifdef SKEY
|
|
||||||
{MONITOR_REQ_SKEYQUERY, MON_ISAUTH, mm_answer_skeyquery},
|
|
||||||
{MONITOR_REQ_SKEYRESPOND, MON_AUTH, mm_answer_skeyrespond},
|
|
||||||
@@ -267,16 +271,17 @@ struct mon_table mon_dispatch_postauth20
|
|
||||||
{MONITOR_REQ_TERM, 0, mm_answer_term},
|
|
||||||
#ifdef SSH_AUDIT_EVENTS
|
|
||||||
{MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
|
|
||||||
{MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT, mm_answer_audit_command},
|
|
||||||
{MONITOR_REQ_AUDIT_END_COMMAND, MON_PERMIT, mm_answer_audit_end_command},
|
|
||||||
{MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},
|
|
||||||
{MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},
|
|
||||||
{MONITOR_REQ_AUDIT_SESSION_KEY_FREE, MON_PERMIT, mm_answer_audit_session_key_free_body},
|
|
||||||
+ {MONITOR_REQ_AUDIT_SERVER_KEY_FREE, MON_PERMIT, mm_answer_audit_server_key_free},
|
|
||||||
#endif
|
|
||||||
{0, 0, NULL}
|
|
||||||
};
|
|
||||||
|
|
||||||
struct mon_table mon_dispatch_proto15[] = {
|
|
||||||
{MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow},
|
|
||||||
{MONITOR_REQ_SESSKEY, MON_ONCE, mm_answer_sesskey},
|
|
||||||
{MONITOR_REQ_SESSID, MON_ONCE, mm_answer_sessid},
|
|
||||||
@@ -301,31 +306,33 @@ struct mon_table mon_dispatch_proto15[]
|
|
||||||
{MONITOR_REQ_PAM_RESPOND, MON_ISAUTH, mm_answer_pam_respond},
|
|
||||||
{MONITOR_REQ_PAM_FREE_CTX, MON_ONCE|MON_AUTHDECIDE, mm_answer_pam_free_ctx},
|
|
||||||
#endif
|
|
||||||
#ifdef SSH_AUDIT_EVENTS
|
|
||||||
{MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
|
|
||||||
{MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},
|
|
||||||
{MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},
|
|
||||||
{MONITOR_REQ_AUDIT_SESSION_KEY_FREE, MON_PERMIT, mm_answer_audit_session_key_free_body},
|
|
||||||
+ {MONITOR_REQ_AUDIT_SERVER_KEY_FREE, MON_PERMIT, mm_answer_audit_server_key_free},
|
|
||||||
#endif
|
|
||||||
{0, 0, NULL}
|
|
||||||
};
|
|
||||||
|
|
||||||
struct mon_table mon_dispatch_postauth15[] = {
|
|
||||||
{MONITOR_REQ_PTY, MON_ONCE, mm_answer_pty},
|
|
||||||
{MONITOR_REQ_PTYCLEANUP, MON_ONCE, mm_answer_pty_cleanup},
|
|
||||||
{MONITOR_REQ_TERM, 0, mm_answer_term},
|
|
||||||
#ifdef SSH_AUDIT_EVENTS
|
|
||||||
{MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
|
|
||||||
{MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT|MON_ONCE, mm_answer_audit_command},
|
|
||||||
{MONITOR_REQ_AUDIT_END_COMMAND, MON_PERMIT, mm_answer_audit_end_command},
|
|
||||||
{MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},
|
|
||||||
{MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},
|
|
||||||
{MONITOR_REQ_AUDIT_SESSION_KEY_FREE, MON_PERMIT, mm_answer_audit_session_key_free_body},
|
|
||||||
+ {MONITOR_REQ_AUDIT_SERVER_KEY_FREE, MON_PERMIT, mm_answer_audit_server_key_free},
|
|
||||||
#endif
|
|
||||||
{0, 0, NULL}
|
|
||||||
};
|
|
||||||
|
|
||||||
struct mon_table *mon_dispatch;
|
|
||||||
|
|
||||||
/* Specifies if a certain message is allowed at the moment */
|
|
||||||
|
|
||||||
@@ -1739,16 +1746,18 @@ mm_answer_term(int sock, Buffer *req)
|
|
||||||
/* The child is terminating */
|
|
||||||
session_destroy_all(&mm_session_close);
|
|
||||||
|
|
||||||
#ifdef USE_PAM
|
|
||||||
if (options.use_pam)
|
|
||||||
sshpam_cleanup();
|
|
||||||
#endif
|
|
||||||
|
|
||||||
+ destroy_sensitive_data(0);
|
|
||||||
+
|
|
||||||
while (waitpid(pmonitor->m_pid, &status, 0) == -1)
|
|
||||||
if (errno != EINTR)
|
|
||||||
exit(1);
|
|
||||||
|
|
||||||
res = WIFEXITED(status) ? WEXITSTATUS(status) : 1;
|
|
||||||
|
|
||||||
/* Terminate process */
|
|
||||||
exit(res);
|
|
||||||
@@ -2280,10 +2289,31 @@ mm_answer_audit_session_key_free_body(in
|
|
||||||
|
|
||||||
audit_session_key_free_body(ctos, pid, uid);
|
|
||||||
|
|
||||||
buffer_clear(m);
|
|
||||||
|
|
||||||
mm_request_send(sock, MONITOR_ANS_AUDIT_SESSION_KEY_FREE, m);
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
+
|
|
||||||
+int
|
|
||||||
+mm_answer_audit_server_key_free(int sock, Buffer *m)
|
|
||||||
+{
|
|
||||||
+ int len;
|
|
||||||
+ char *fp;
|
|
||||||
+ pid_t pid;
|
|
||||||
+ uid_t uid;
|
|
||||||
+
|
|
||||||
+ fp = buffer_get_string(m, &len);
|
|
||||||
+ pid = buffer_get_int64(m);
|
|
||||||
+ uid = buffer_get_int64(m);
|
|
||||||
+
|
|
||||||
+ audit_destroy_sensitive_data(fp, pid, uid);
|
|
||||||
+
|
|
||||||
+ free(fp);
|
|
||||||
+ buffer_clear(m);
|
|
||||||
+
|
|
||||||
+ mm_request_send(sock, MONITOR_ANS_AUDIT_SERVER_KEY_FREE, m);
|
|
||||||
+ return 0;
|
|
||||||
+}
|
|
||||||
#endif /* SSH_AUDIT_EVENTS */
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/monitor.h b/openssh-6.6p1/monitor.h
|
|
||||||
--- a/openssh-6.6p1/monitor.h
|
|
||||||
+++ b/openssh-6.6p1/monitor.h
|
|
||||||
@@ -63,16 +63,17 @@ enum monitor_reqtype {
|
|
||||||
MONITOR_REQ_PAM_QUERY = 106, MONITOR_ANS_PAM_QUERY = 107,
|
|
||||||
MONITOR_REQ_PAM_RESPOND = 108, MONITOR_ANS_PAM_RESPOND = 109,
|
|
||||||
MONITOR_REQ_PAM_FREE_CTX = 110, MONITOR_ANS_PAM_FREE_CTX = 111,
|
|
||||||
MONITOR_REQ_AUDIT_EVENT = 112, MONITOR_REQ_AUDIT_COMMAND = 113,
|
|
||||||
MONITOR_ANS_AUDIT_COMMAND = 114, MONITOR_REQ_AUDIT_END_COMMAND = 115,
|
|
||||||
MONITOR_REQ_AUDIT_UNSUPPORTED = 116, MONITOR_ANS_AUDIT_UNSUPPORTED = 117,
|
|
||||||
MONITOR_REQ_AUDIT_KEX = 118, MONITOR_ANS_AUDIT_KEX = 119,
|
|
||||||
MONITOR_REQ_AUDIT_SESSION_KEY_FREE = 120, MONITOR_ANS_AUDIT_SESSION_KEY_FREE = 121,
|
|
||||||
+ MONITOR_REQ_AUDIT_SERVER_KEY_FREE = 122, MONITOR_ANS_AUDIT_SERVER_KEY_FREE = 123,
|
|
||||||
|
|
||||||
};
|
|
||||||
|
|
||||||
struct mm_master;
|
|
||||||
struct monitor {
|
|
||||||
int m_recvfd;
|
|
||||||
int m_sendfd;
|
|
||||||
int m_log_recvfd;
|
|
||||||
diff --git a/openssh-6.6p1/monitor_wrap.c b/openssh-6.6p1/monitor_wrap.c
|
|
||||||
--- a/openssh-6.6p1/monitor_wrap.c
|
|
||||||
+++ b/openssh-6.6p1/monitor_wrap.c
|
|
||||||
@@ -1373,10 +1373,26 @@ mm_audit_session_key_free_body(int ctos,
|
|
||||||
buffer_put_int(&m, ctos);
|
|
||||||
buffer_put_int64(&m, pid);
|
|
||||||
buffer_put_int64(&m, uid);
|
|
||||||
mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_SESSION_KEY_FREE, &m);
|
|
||||||
mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_AUDIT_SESSION_KEY_FREE,
|
|
||||||
&m);
|
|
||||||
buffer_free(&m);
|
|
||||||
}
|
|
||||||
+
|
|
||||||
+void
|
|
||||||
+mm_audit_destroy_sensitive_data(const char *fp, pid_t pid, uid_t uid)
|
|
||||||
+{
|
|
||||||
+ Buffer m;
|
|
||||||
+
|
|
||||||
+ buffer_init(&m);
|
|
||||||
+ buffer_put_cstring(&m, fp);
|
|
||||||
+ buffer_put_int64(&m, pid);
|
|
||||||
+ buffer_put_int64(&m, uid);
|
|
||||||
+
|
|
||||||
+ mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_SERVER_KEY_FREE, &m);
|
|
||||||
+ mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_AUDIT_SERVER_KEY_FREE,
|
|
||||||
+ &m);
|
|
||||||
+ buffer_free(&m);
|
|
||||||
+}
|
|
||||||
#endif /* SSH_AUDIT_EVENTS */
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/monitor_wrap.h b/openssh-6.6p1/monitor_wrap.h
|
|
||||||
--- a/openssh-6.6p1/monitor_wrap.h
|
|
||||||
+++ b/openssh-6.6p1/monitor_wrap.h
|
|
||||||
@@ -75,16 +75,17 @@ void mm_sshpam_free_ctx(void *);
|
|
||||||
#ifdef SSH_AUDIT_EVENTS
|
|
||||||
#include "audit.h"
|
|
||||||
void mm_audit_event(ssh_audit_event_t);
|
|
||||||
int mm_audit_run_command(const char *);
|
|
||||||
void mm_audit_end_command(int, const char *);
|
|
||||||
void mm_audit_unsupported_body(int);
|
|
||||||
void mm_audit_kex_body(int, char *, char *, char *, pid_t, uid_t);
|
|
||||||
void mm_audit_session_key_free_body(int, pid_t, uid_t);
|
|
||||||
+void mm_audit_destroy_sensitive_data(const char *, pid_t, uid_t);
|
|
||||||
#endif
|
|
||||||
|
|
||||||
struct Session;
|
|
||||||
void mm_terminate(void);
|
|
||||||
int mm_pty_allocate(int *, int *, char *, size_t);
|
|
||||||
void mm_session_pty_cleanup2(struct Session *);
|
|
||||||
|
|
||||||
/* SSHv1 interfaces */
|
|
||||||
diff --git a/openssh-6.6p1/session.c b/openssh-6.6p1/session.c
|
|
||||||
--- a/openssh-6.6p1/session.c
|
|
||||||
+++ b/openssh-6.6p1/session.c
|
|
||||||
@@ -132,17 +132,17 @@ static int session_pty_req(Session *);
|
|
||||||
|
|
||||||
/* import */
|
|
||||||
extern ServerOptions options;
|
|
||||||
extern char *__progname;
|
|
||||||
extern int log_stderr;
|
|
||||||
extern int debug_flag;
|
|
||||||
extern u_int utmp_len;
|
|
||||||
extern int startup_pipe;
|
|
||||||
-extern void destroy_sensitive_data(void);
|
|
||||||
+extern void destroy_sensitive_data(int);
|
|
||||||
extern Buffer loginmsg;
|
|
||||||
|
|
||||||
/* original command from peer. */
|
|
||||||
const char *original_command = NULL;
|
|
||||||
|
|
||||||
/* data */
|
|
||||||
static int sessions_first_unused = -1;
|
|
||||||
static int sessions_nalloc = 0;
|
|
||||||
@@ -1693,17 +1693,17 @@ do_child(Session *s, const char *command
|
|
||||||
char **env;
|
|
||||||
int env_size;
|
|
||||||
char *argv[ARGV_MAX];
|
|
||||||
const char *shell, *shell0, *hostname = NULL;
|
|
||||||
struct passwd *pw = s->pw;
|
|
||||||
int r = 0;
|
|
||||||
|
|
||||||
/* remove hostkey from the child's memory */
|
|
||||||
- destroy_sensitive_data();
|
|
||||||
+ destroy_sensitive_data(1);
|
|
||||||
/* Don't audit this - both us and the parent would be talking to the
|
|
||||||
monitor over a single socket, with no synchronization. */
|
|
||||||
packet_destroy_all(0, 1);
|
|
||||||
|
|
||||||
/* Force a password change */
|
|
||||||
if (s->authctxt->force_pwchange) {
|
|
||||||
do_setusercontext(pw);
|
|
||||||
child_close_fds();
|
|
||||||
diff --git a/openssh-6.6p1/sshd.c b/openssh-6.6p1/sshd.c
|
|
||||||
--- a/openssh-6.6p1/sshd.c
|
|
||||||
+++ b/openssh-6.6p1/sshd.c
|
|
||||||
@@ -259,17 +259,17 @@ Buffer cfg;
|
|
||||||
|
|
||||||
/* message to be displayed after login */
|
|
||||||
Buffer loginmsg;
|
|
||||||
|
|
||||||
/* Unprivileged user */
|
|
||||||
struct passwd *privsep_pw = NULL;
|
|
||||||
|
|
||||||
/* Prototypes for various functions defined later in this file. */
|
|
||||||
-void destroy_sensitive_data(void);
|
|
||||||
+void destroy_sensitive_data(int);
|
|
||||||
void demote_sensitive_data(void);
|
|
||||||
|
|
||||||
static void do_ssh1_kex(void);
|
|
||||||
static void do_ssh2_kex(void);
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Close all listening sockets
|
|
||||||
*/
|
|
||||||
@@ -278,16 +278,25 @@ close_listen_socks(void)
|
|
||||||
{
|
|
||||||
int i;
|
|
||||||
|
|
||||||
for (i = 0; i < num_listen_socks; i++)
|
|
||||||
close(listen_socks[i]);
|
|
||||||
num_listen_socks = -1;
|
|
||||||
}
|
|
||||||
|
|
||||||
+/*
|
|
||||||
+ * Is this process listening for clients (i.e. not specific to any specific
|
|
||||||
+ * client connection?)
|
|
||||||
+ */
|
|
||||||
+int listening_for_clients(void)
|
|
||||||
+{
|
|
||||||
+ return num_listen_socks > 0;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
static void
|
|
||||||
close_startup_pipes(void)
|
|
||||||
{
|
|
||||||
int i;
|
|
||||||
|
|
||||||
if (startup_pipes)
|
|
||||||
for (i = 0; i < options.max_startups; i++)
|
|
||||||
if (startup_pipes[i] != -1)
|
|
||||||
@@ -557,60 +566,99 @@ sshd_exchange_identification(int sock_in
|
|
||||||
close(sock_out);
|
|
||||||
logit("Protocol major versions differ for %s: %.200s vs. %.200s",
|
|
||||||
get_remote_ipaddr(),
|
|
||||||
server_version_string, client_version_string);
|
|
||||||
cleanup_exit(255);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
-/* Destroy the host and server keys. They will no longer be needed. */
|
|
||||||
+/*
|
|
||||||
+ * Destroy the host and server keys. They will no longer be needed. Careful,
|
|
||||||
+ * this can be called from cleanup_exit() - i.e. from just about anywhere.
|
|
||||||
+ */
|
|
||||||
void
|
|
||||||
-destroy_sensitive_data(void)
|
|
||||||
+destroy_sensitive_data(int privsep)
|
|
||||||
{
|
|
||||||
int i;
|
|
||||||
+ pid_t pid;
|
|
||||||
+ uid_t uid;
|
|
||||||
|
|
||||||
if (sensitive_data.server_key) {
|
|
||||||
key_free(sensitive_data.server_key);
|
|
||||||
sensitive_data.server_key = NULL;
|
|
||||||
}
|
|
||||||
+ pid = getpid();
|
|
||||||
+ uid = getuid();
|
|
||||||
for (i = 0; i < options.num_host_key_files; i++) {
|
|
||||||
if (sensitive_data.host_keys[i]) {
|
|
||||||
+ char *fp;
|
|
||||||
+
|
|
||||||
+ if (key_is_private(sensitive_data.host_keys[i]))
|
|
||||||
+ fp = key_fingerprint(sensitive_data.host_keys[i],
|
|
||||||
+ key_fp_type_select(), SSH_FP_HEX);
|
|
||||||
+ else
|
|
||||||
+ fp = NULL;
|
|
||||||
key_free(sensitive_data.host_keys[i]);
|
|
||||||
sensitive_data.host_keys[i] = NULL;
|
|
||||||
+ if (fp != NULL) {
|
|
||||||
+ if (privsep)
|
|
||||||
+ PRIVSEP(audit_destroy_sensitive_data(fp,
|
|
||||||
+ pid, uid));
|
|
||||||
+ else
|
|
||||||
+ audit_destroy_sensitive_data(fp,
|
|
||||||
+ pid, uid);
|
|
||||||
+ free(fp);
|
|
||||||
+ }
|
|
||||||
}
|
|
||||||
- if (sensitive_data.host_certificates[i]) {
|
|
||||||
+ if (sensitive_data.host_certificates
|
|
||||||
+ && sensitive_data.host_certificates[i]) {
|
|
||||||
key_free(sensitive_data.host_certificates[i]);
|
|
||||||
sensitive_data.host_certificates[i] = NULL;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
sensitive_data.ssh1_host_key = NULL;
|
|
||||||
explicit_bzero(sensitive_data.ssh1_cookie, SSH_SESSION_KEY_LENGTH);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* Demote private to public keys for network child */
|
|
||||||
void
|
|
||||||
demote_sensitive_data(void)
|
|
||||||
{
|
|
||||||
Key *tmp;
|
|
||||||
+ pid_t pid;
|
|
||||||
+ uid_t uid;
|
|
||||||
int i;
|
|
||||||
|
|
||||||
+ pid = getpid();
|
|
||||||
+ uid = getuid();
|
|
||||||
if (sensitive_data.server_key) {
|
|
||||||
tmp = key_demote(sensitive_data.server_key);
|
|
||||||
key_free(sensitive_data.server_key);
|
|
||||||
sensitive_data.server_key = tmp;
|
|
||||||
}
|
|
||||||
|
|
||||||
for (i = 0; i < options.num_host_key_files; i++) {
|
|
||||||
if (sensitive_data.host_keys[i]) {
|
|
||||||
+ char *fp;
|
|
||||||
+
|
|
||||||
+ if (key_is_private(sensitive_data.host_keys[i]))
|
|
||||||
+ fp = key_fingerprint(sensitive_data.host_keys[i],
|
|
||||||
+ key_fp_type_select(), SSH_FP_HEX);
|
|
||||||
+ else
|
|
||||||
+ fp = NULL;
|
|
||||||
tmp = key_demote(sensitive_data.host_keys[i]);
|
|
||||||
key_free(sensitive_data.host_keys[i]);
|
|
||||||
sensitive_data.host_keys[i] = tmp;
|
|
||||||
if (tmp->type == KEY_RSA1)
|
|
||||||
sensitive_data.ssh1_host_key = tmp;
|
|
||||||
+ if (fp != NULL) {
|
|
||||||
+ audit_destroy_sensitive_data(fp, pid, uid);
|
|
||||||
+ free(fp);
|
|
||||||
+ }
|
|
||||||
}
|
|
||||||
/* Certs do not need demotion */
|
|
||||||
}
|
|
||||||
|
|
||||||
/* We do not clear ssh1_host key and cookie. XXX - Okay Niels? */
|
|
||||||
}
|
|
||||||
|
|
||||||
static void
|
|
||||||
@@ -1201,16 +1249,17 @@ server_accept_loop(int *sock_in, int *so
|
|
||||||
|
|
||||||
/* Wait in select until there is a connection. */
|
|
||||||
ret = select(maxfd+1, fdset, NULL, NULL, NULL);
|
|
||||||
if (ret < 0 && errno != EINTR)
|
|
||||||
error("select: %.100s", strerror(errno));
|
|
||||||
if (received_sigterm) {
|
|
||||||
logit("Received signal %d; terminating.",
|
|
||||||
(int) received_sigterm);
|
|
||||||
+ destroy_sensitive_data(0);
|
|
||||||
close_listen_socks();
|
|
||||||
unlink(options.pid_file);
|
|
||||||
exit(received_sigterm == SIGTERM ? 0 : 255);
|
|
||||||
}
|
|
||||||
if (key_used && key_do_regen) {
|
|
||||||
generate_ephemeral_server_key();
|
|
||||||
key_used = 0;
|
|
||||||
key_do_regen = 0;
|
|
||||||
@@ -2167,27 +2216,28 @@ main(int ac, char **av)
|
|
||||||
/*
|
|
||||||
* In privilege separation, we fork another child and prepare
|
|
||||||
* file descriptor passing.
|
|
||||||
*/
|
|
||||||
if (use_privsep) {
|
|
||||||
privsep_postauth(authctxt);
|
|
||||||
/* the monitor process [priv] will not return */
|
|
||||||
if (!compat20)
|
|
||||||
- destroy_sensitive_data();
|
|
||||||
+ destroy_sensitive_data(0);
|
|
||||||
}
|
|
||||||
|
|
||||||
packet_set_timeout(options.client_alive_interval,
|
|
||||||
options.client_alive_count_max);
|
|
||||||
|
|
||||||
/* Start session. */
|
|
||||||
do_authenticated(authctxt);
|
|
||||||
|
|
||||||
/* The connection has been terminated. */
|
|
||||||
packet_destroy_all(1, 1);
|
|
||||||
+ destroy_sensitive_data(1);
|
|
||||||
|
|
||||||
packet_get_state(MODE_IN, NULL, NULL, NULL, &ibytes);
|
|
||||||
packet_get_state(MODE_OUT, NULL, NULL, NULL, &obytes);
|
|
||||||
verbose("Transferred: sent %llu, received %llu bytes",
|
|
||||||
(unsigned long long)obytes, (unsigned long long)ibytes);
|
|
||||||
|
|
||||||
verbose("Closing connection to %.500s port %d", remote_ip, remote_port);
|
|
||||||
|
|
||||||
@@ -2412,17 +2462,17 @@ do_ssh1_kex(void)
|
|
||||||
fatal("%s: hash failed", __func__);
|
|
||||||
ssh_digest_free(md);
|
|
||||||
explicit_bzero(buf, bytes);
|
|
||||||
free(buf);
|
|
||||||
for (i = 0; i < 16; i++)
|
|
||||||
session_id[i] = session_key[i] ^ session_key[i + 16];
|
|
||||||
}
|
|
||||||
/* Destroy the private and public keys. No longer. */
|
|
||||||
- destroy_sensitive_data();
|
|
||||||
+ destroy_sensitive_data(0);
|
|
||||||
|
|
||||||
if (use_privsep)
|
|
||||||
mm_ssh1_session_id(session_id);
|
|
||||||
|
|
||||||
/* Destroy the decrypted integer. It is no longer needed. */
|
|
||||||
BN_clear_free(session_key_int);
|
|
||||||
|
|
||||||
/* Set the session key. From this on all communications will be encrypted. */
|
|
||||||
@@ -2556,16 +2606,18 @@ cleanup_exit(int i)
|
|
||||||
debug("Killing privsep child %d", pmonitor->m_pid);
|
|
||||||
if (kill(pmonitor->m_pid, SIGKILL) != 0 &&
|
|
||||||
errno != ESRCH)
|
|
||||||
error("%s: kill(%d): %s", __func__,
|
|
||||||
pmonitor->m_pid, strerror(errno));
|
|
||||||
}
|
|
||||||
}
|
|
||||||
is_privsep_child = use_privsep && (pmonitor != NULL) && !mm_is_monitor();
|
|
||||||
+ if (sensitive_data.host_keys != NULL)
|
|
||||||
+ destroy_sensitive_data(is_privsep_child);
|
|
||||||
packet_destroy_all(1, is_privsep_child);
|
|
||||||
#ifdef SSH_AUDIT_EVENTS
|
|
||||||
/* done after do_cleanup so it can cancel the PAM auth 'thread' */
|
|
||||||
if ((the_authctxt == NULL || !the_authctxt->authenticated) &&
|
|
||||||
(!use_privsep || mm_is_monitor()))
|
|
||||||
audit_event(SSH_CONNECTION_ABANDON);
|
|
||||||
#endif
|
|
||||||
_exit(i);
|
|
@ -1,107 +0,0 @@
|
|||||||
# definitions for AUDIT_CRYPTO_* symbols fom libaudit 2.x
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/audit-linux.c b/openssh-6.6p1/audit-linux.c
|
|
||||||
--- a/openssh-6.6p1/audit-linux.c
|
|
||||||
+++ b/openssh-6.6p1/audit-linux.c
|
|
||||||
@@ -25,16 +25,17 @@
|
|
||||||
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
||||||
*
|
|
||||||
* Red Hat author: Jan F. Chadima <jchadima@redhat.com>
|
|
||||||
*/
|
|
||||||
|
|
||||||
#include "includes.h"
|
|
||||||
#if defined(USE_LINUX_AUDIT)
|
|
||||||
#include <libaudit.h>
|
|
||||||
+#include "compat-libaudit.h"
|
|
||||||
#include <unistd.h>
|
|
||||||
#include <string.h>
|
|
||||||
|
|
||||||
#include "log.h"
|
|
||||||
#include "audit.h"
|
|
||||||
#include "key.h"
|
|
||||||
#include "hostfile.h"
|
|
||||||
#include "auth.h"
|
|
||||||
diff --git a/openssh-6.6p1/compat-libaudit.h b/openssh-6.6p1/compat-libaudit.h
|
|
||||||
new file mode 100644
|
|
||||||
--- /dev/null
|
|
||||||
+++ b/openssh-6.6p1/compat-libaudit.h
|
|
||||||
@@ -0,0 +1,79 @@
|
|
||||||
+/* AUDIT_CRYPTO symbol definitions from libaudit 2.x */
|
|
||||||
+/* libaudit.h --
|
|
||||||
+ * Copyright 2004-2011 Red Hat Inc., Durham, North Carolina.
|
|
||||||
+ * All Rights Reserved.
|
|
||||||
+ *
|
|
||||||
+ * This library is free software; you can redistribute it and/or
|
|
||||||
+ * modify it under the terms of the GNU Lesser General Public
|
|
||||||
+ * License as published by the Free Software Foundation; either
|
|
||||||
+ * version 2.1 of the License, or (at your option) any later version.
|
|
||||||
+ *
|
|
||||||
+ * This library is distributed in the hope that it will be useful,
|
|
||||||
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
||||||
+ * Lesser General Public License for more details.
|
|
||||||
+ *
|
|
||||||
+ * You should have received a copy of the GNU Lesser General Public
|
|
||||||
+ * License along with this library; if not, write to the Free Software
|
|
||||||
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
|
||||||
+ *
|
|
||||||
+ * Authors:
|
|
||||||
+ * Steve Grubb <sgrubb@redhat.com>
|
|
||||||
+ * Rickard E. (Rik) Faith <faith@redhat.com>
|
|
||||||
+ */
|
|
||||||
+#ifndef _COMPAT_LIBAUDIT_H_
|
|
||||||
+#define _COMPAT_LIBAUDIT_H_
|
|
||||||
+
|
|
||||||
+#ifdef __cplusplus
|
|
||||||
+extern "C" {
|
|
||||||
+#endif
|
|
||||||
+
|
|
||||||
+#ifndef AUDIT_FIRST_CRYPTO_MSG
|
|
||||||
+#define AUDIT_FIRST_CRYPTO_MSG 2400
|
|
||||||
+#endif
|
|
||||||
+
|
|
||||||
+#ifndef AUDIT_CRYPTO_TEST_USER
|
|
||||||
+#define AUDIT_CRYPTO_TEST_USER 2400 /* Crypto test results */
|
|
||||||
+#endif
|
|
||||||
+
|
|
||||||
+#ifndef AUDIT_CRYPTO_PARAM_CHANGE_USER
|
|
||||||
+#define AUDIT_CRYPTO_PARAM_CHANGE_USER 2401 /* Crypto attribute change */
|
|
||||||
+#endif
|
|
||||||
+
|
|
||||||
+#ifndef AUDIT_CRYPTO_LOGIN
|
|
||||||
+#define AUDIT_CRYPTO_LOGIN 2402 /* Logged in as crypto officer */
|
|
||||||
+#endif
|
|
||||||
+
|
|
||||||
+#ifndef AUDIT_CRYPTO_LOGOUT
|
|
||||||
+#define AUDIT_CRYPTO_LOGOUT 2403 /* Logged out from crypto */
|
|
||||||
+#endif
|
|
||||||
+
|
|
||||||
+#ifndef AUDIT_CRYPTO_KEY_USER
|
|
||||||
+#define AUDIT_CRYPTO_KEY_USER 2404 /* Create,delete,negotiate */
|
|
||||||
+#endif
|
|
||||||
+
|
|
||||||
+#ifndef AUDIT_CRYPTO_FAILURE_USER
|
|
||||||
+#define AUDIT_CRYPTO_FAILURE_USER 2405 /* Fail decrypt,encrypt,randomiz */
|
|
||||||
+#endif
|
|
||||||
+
|
|
||||||
+#ifndef AUDIT_CRYPTO_REPLAY_USER
|
|
||||||
+#define AUDIT_CRYPTO_REPLAY_USER 2406 /* Crypto replay detected */
|
|
||||||
+#endif
|
|
||||||
+
|
|
||||||
+#ifndef AUDIT_CRYPTO_SESSION
|
|
||||||
+#define AUDIT_CRYPTO_SESSION 2407 /* Record parameters set during
|
|
||||||
+ TLS session establishment */
|
|
||||||
+#endif
|
|
||||||
+
|
|
||||||
+
|
|
||||||
+#ifndef AUDIT_LAST_CRYPTO_MSG
|
|
||||||
+#define AUDIT_LAST_CRYPTO_MSG 2499
|
|
||||||
+#endif
|
|
||||||
+
|
|
||||||
+
|
|
||||||
+#ifdef __cplusplus
|
|
||||||
+}
|
|
||||||
+#endif
|
|
||||||
+
|
|
||||||
+#endif /* _COMPAT_LIBAUDIT_H_ */
|
|
||||||
+
|
|
@ -1,47 +0,0 @@
|
|||||||
# bnc#752354, bnc#757360
|
|
||||||
# prevent timeouts in libaudit code caused by DNS misconfiguration by
|
|
||||||
# explicitely disabling DNS lookups in libaudit when UseDNS is false.
|
|
||||||
# Note that this particular solution causes the logs to always contain
|
|
||||||
# "hostname=?, addr=?" when DNS lookups are disabled.
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/audit-linux.c b/openssh-6.6p1/audit-linux.c
|
|
||||||
--- a/openssh-6.6p1/audit-linux.c
|
|
||||||
+++ b/openssh-6.6p1/audit-linux.c
|
|
||||||
@@ -62,17 +62,17 @@ linux_audit_user_logxxx(int uid, const c
|
|
||||||
if (errno == EINVAL || errno == EPROTONOSUPPORT ||
|
|
||||||
errno == EAFNOSUPPORT)
|
|
||||||
return; /* No audit support in kernel */
|
|
||||||
else
|
|
||||||
goto fatal_report; /* Must prevent login */
|
|
||||||
}
|
|
||||||
rc = audit_log_acct_message(audit_fd, event,
|
|
||||||
NULL, "login", username ? username : "(unknown)",
|
|
||||||
- username == NULL ? uid : -1, hostname, ip, ttyn, success);
|
|
||||||
+ username == NULL ? uid : -1, options.use_dns ? hostname : NULL, ip, ttyn, success);
|
|
||||||
saved_errno = errno;
|
|
||||||
close(audit_fd);
|
|
||||||
/*
|
|
||||||
* Do not report error if the error is EPERM and sshd is run as non
|
|
||||||
* root user.
|
|
||||||
*/
|
|
||||||
if ((rc == -EPERM) && (geteuid() != 0))
|
|
||||||
rc = 0;
|
|
||||||
@@ -114,17 +114,17 @@ linux_audit_user_auth(int uid, const cha
|
|
||||||
goto fatal_report; /* Must prevent login */
|
|
||||||
}
|
|
||||||
|
|
||||||
if ((event < 0) || (event > SSH_AUDIT_UNKNOWN))
|
|
||||||
event = SSH_AUDIT_UNKNOWN;
|
|
||||||
|
|
||||||
rc = audit_log_acct_message(audit_fd, AUDIT_USER_AUTH,
|
|
||||||
NULL, event_name[event], username ? username : "(unknown)",
|
|
||||||
- username == NULL ? uid : -1, hostname, ip, ttyn, success);
|
|
||||||
+ username == NULL ? uid : -1, options.use_dns ? hostname : NULL, ip, ttyn, success);
|
|
||||||
saved_errno = errno;
|
|
||||||
close(audit_fd);
|
|
||||||
/*
|
|
||||||
* Do not report error if the error is EPERM and sshd is run as non
|
|
||||||
* root user.
|
|
||||||
*/
|
|
||||||
if ((rc == -EPERM) && (geteuid() != 0))
|
|
||||||
rc = 0;
|
|
@ -1,205 +0,0 @@
|
|||||||
# Date: Sun, 20 Apr 2014 17:14:08 +1000 (EST)
|
|
||||||
# From: Damien Miller <djm@mindrot.org>
|
|
||||||
# To: openssh-unix-dev@mindrot.org
|
|
||||||
# Subject: bad bignum encoding for curve25519-sha256@libssh.org
|
|
||||||
# Message-ID: <alpine.BSO.2.11.1404201713390.26134@natsu.mindrot.org>
|
|
||||||
#
|
|
||||||
# Hi,
|
|
||||||
#
|
|
||||||
# So I screwed up when writing the support for the curve25519 KEX method
|
|
||||||
# that doesn't depend on OpenSSL's BIGNUM type - a bug in my code left
|
|
||||||
# leading zero bytes where they should have been skipped. The impact of
|
|
||||||
# this is that OpenSSH 6.5 and 6.6 will fail during key exchange with a
|
|
||||||
# peer that implements curve25519-sha256@libssh.org properly about 0.2%
|
|
||||||
# of the time (one in every 512ish connections).
|
|
||||||
#
|
|
||||||
# We've fixed this for OpenSSH 6.7 by avoiding the curve25519-sha256
|
|
||||||
# key exchange for previous versions, but I'd recommend distributors
|
|
||||||
# of OpenSSH apply this patch so the affected code doesn't become
|
|
||||||
# too entrenched in LTS releases.
|
|
||||||
#
|
|
||||||
# The patch fixes the bug and makes OpenSSH identify itself as 6.6.1 so as
|
|
||||||
# to distinguish itself from the incorrect versions so the compatibility
|
|
||||||
# code to disable the affected KEX isn't activated.
|
|
||||||
#
|
|
||||||
# I've committed this on the 6.6 branch too.
|
|
||||||
#
|
|
||||||
# Apologies for the hassle.
|
|
||||||
#
|
|
||||||
# -d
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/bufaux.c b/openssh-6.6p1/bufaux.c
|
|
||||||
--- a/openssh-6.6p1/bufaux.c
|
|
||||||
+++ b/openssh-6.6p1/bufaux.c
|
|
||||||
@@ -1,9 +1,9 @@
|
|
||||||
-/* $OpenBSD: bufaux.c,v 1.56 2014/02/02 03:44:31 djm Exp $ */
|
|
||||||
+/* $OpenBSD: bufaux.c,v 1.57 2014/04/16 23:22:45 djm Exp $ */
|
|
||||||
/*
|
|
||||||
* Author: Tatu Ylonen <ylo@cs.hut.fi>
|
|
||||||
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
|
|
||||||
* All rights reserved
|
|
||||||
* Auxiliary functions for storing and retrieving various data types to/from
|
|
||||||
* Buffers.
|
|
||||||
*
|
|
||||||
* As far as I am concerned, the code I have written for this software
|
|
||||||
@@ -367,16 +367,19 @@ buffer_get_bignum2_as_string(Buffer *buf
|
|
||||||
void
|
|
||||||
buffer_put_bignum2_from_string(Buffer *buffer, const u_char *s, u_int l)
|
|
||||||
{
|
|
||||||
u_char *buf, *p;
|
|
||||||
int pad = 0;
|
|
||||||
|
|
||||||
if (l > 8 * 1024)
|
|
||||||
fatal("%s: length %u too long", __func__, l);
|
|
||||||
+ /* Skip leading zero bytes */
|
|
||||||
+ for (; l > 0 && *s == 0; l--, s++)
|
|
||||||
+ ;
|
|
||||||
p = buf = xmalloc(l + 1);
|
|
||||||
/*
|
|
||||||
* If most significant bit is set then prepend a zero byte to
|
|
||||||
* avoid interpretation as a negative number.
|
|
||||||
*/
|
|
||||||
if (l > 0 && (s[0] & 0x80) != 0) {
|
|
||||||
*p++ = '\0';
|
|
||||||
pad = 1;
|
|
||||||
diff --git a/openssh-6.6p1/compat.c b/openssh-6.6p1/compat.c
|
|
||||||
--- a/openssh-6.6p1/compat.c
|
|
||||||
+++ b/openssh-6.6p1/compat.c
|
|
||||||
@@ -90,16 +90,19 @@ compat_datafellows(const char *version)
|
|
||||||
SSH_OLD_FORWARD_ADDR},
|
|
||||||
{ "OpenSSH_2.*,"
|
|
||||||
"OpenSSH_3.0*,"
|
|
||||||
"OpenSSH_3.1*", SSH_BUG_EXTEOF|SSH_OLD_FORWARD_ADDR},
|
|
||||||
{ "OpenSSH_3.*", SSH_OLD_FORWARD_ADDR },
|
|
||||||
{ "Sun_SSH_1.0*", SSH_BUG_NOREKEY|SSH_BUG_EXTEOF},
|
|
||||||
{ "OpenSSH_4*", 0 },
|
|
||||||
{ "OpenSSH_5*", SSH_NEW_OPENSSH|SSH_BUG_DYNAMIC_RPORT},
|
|
||||||
+ { "OpenSSH_6.6.1*", SSH_NEW_OPENSSH},
|
|
||||||
+ { "OpenSSH_6.5*,"
|
|
||||||
+ "OpenSSH_6.6*", SSH_NEW_OPENSSH|SSH_BUG_CURVE25519PAD},
|
|
||||||
{ "OpenSSH*", SSH_NEW_OPENSSH },
|
|
||||||
{ "*MindTerm*", 0 },
|
|
||||||
{ "2.1.0*", SSH_BUG_SIGBLOB|SSH_BUG_HMAC|
|
|
||||||
SSH_OLD_SESSIONID|SSH_BUG_DEBUG|
|
|
||||||
SSH_BUG_RSASIGMD5|SSH_BUG_HBSERVICE|
|
|
||||||
SSH_BUG_FIRSTKEX },
|
|
||||||
{ "2.1 *", SSH_BUG_SIGBLOB|SSH_BUG_HMAC|
|
|
||||||
SSH_OLD_SESSIONID|SSH_BUG_DEBUG|
|
|
||||||
@@ -246,22 +249,34 @@ compat_cipher_proposal(char *cipher_prop
|
|
||||||
debug2("%s: original cipher proposal: %s", __func__, cipher_prop);
|
|
||||||
cipher_prop = filter_proposal(cipher_prop, "aes*");
|
|
||||||
debug2("%s: compat cipher proposal: %s", __func__, cipher_prop);
|
|
||||||
if (*cipher_prop == '\0')
|
|
||||||
fatal("No supported ciphers found");
|
|
||||||
return cipher_prop;
|
|
||||||
}
|
|
||||||
|
|
||||||
-
|
|
||||||
char *
|
|
||||||
compat_pkalg_proposal(char *pkalg_prop)
|
|
||||||
{
|
|
||||||
if (!(datafellows & SSH_BUG_RSASIGMD5))
|
|
||||||
return pkalg_prop;
|
|
||||||
debug2("%s: original public key proposal: %s", __func__, pkalg_prop);
|
|
||||||
pkalg_prop = filter_proposal(pkalg_prop, "ssh-rsa");
|
|
||||||
debug2("%s: compat public key proposal: %s", __func__, pkalg_prop);
|
|
||||||
if (*pkalg_prop == '\0')
|
|
||||||
fatal("No supported PK algorithms found");
|
|
||||||
return pkalg_prop;
|
|
||||||
}
|
|
||||||
|
|
||||||
+char *
|
|
||||||
+compat_kex_proposal(char *kex_prop)
|
|
||||||
+{
|
|
||||||
+ if (!(datafellows & SSH_BUG_CURVE25519PAD))
|
|
||||||
+ return kex_prop;
|
|
||||||
+ debug2("%s: original KEX proposal: %s", __func__, kex_prop);
|
|
||||||
+ kex_prop = filter_proposal(kex_prop, "curve25519-sha256@libssh.org");
|
|
||||||
+ debug2("%s: compat KEX proposal: %s", __func__, kex_prop);
|
|
||||||
+ if (*kex_prop == '\0')
|
|
||||||
+ fatal("No supported key exchange algorithms found");
|
|
||||||
+ return kex_prop;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
diff --git a/openssh-6.6p1/compat.h b/openssh-6.6p1/compat.h
|
|
||||||
--- a/openssh-6.6p1/compat.h
|
|
||||||
+++ b/openssh-6.6p1/compat.h
|
|
||||||
@@ -54,20 +54,22 @@
|
|
||||||
#define SSH_BUG_DUMMYCHAN 0x00100000
|
|
||||||
#define SSH_BUG_EXTEOF 0x00200000
|
|
||||||
#define SSH_BUG_PROBE 0x00400000
|
|
||||||
#define SSH_BUG_FIRSTKEX 0x00800000
|
|
||||||
#define SSH_OLD_FORWARD_ADDR 0x01000000
|
|
||||||
#define SSH_BUG_RFWD_ADDR 0x02000000
|
|
||||||
#define SSH_NEW_OPENSSH 0x04000000
|
|
||||||
#define SSH_BUG_DYNAMIC_RPORT 0x08000000
|
|
||||||
+#define SSH_BUG_CURVE25519PAD 0x10000000
|
|
||||||
|
|
||||||
void enable_compat13(void);
|
|
||||||
void enable_compat20(void);
|
|
||||||
void compat_datafellows(const char *);
|
|
||||||
int proto_spec(const char *);
|
|
||||||
char *compat_cipher_proposal(char *);
|
|
||||||
char *compat_pkalg_proposal(char *);
|
|
||||||
+char *compat_kex_proposal(char *);
|
|
||||||
|
|
||||||
extern int compat13;
|
|
||||||
extern int compat20;
|
|
||||||
extern int datafellows;
|
|
||||||
#endif
|
|
||||||
diff --git a/openssh-6.6p1/sshconnect2.c b/openssh-6.6p1/sshconnect2.c
|
|
||||||
--- a/openssh-6.6p1/sshconnect2.c
|
|
||||||
+++ b/openssh-6.6p1/sshconnect2.c
|
|
||||||
@@ -190,16 +190,18 @@ ssh_kex2(char *host, struct sockaddr *ho
|
|
||||||
else {
|
|
||||||
/* Prefer algorithms that we already have keys for */
|
|
||||||
myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
|
|
||||||
compat_pkalg_proposal(
|
|
||||||
order_hostkeyalgs(host, hostaddr, port));
|
|
||||||
}
|
|
||||||
if (options.kex_algorithms != NULL)
|
|
||||||
myproposal[PROPOSAL_KEX_ALGS] = options.kex_algorithms;
|
|
||||||
+ myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(
|
|
||||||
+ myproposal[PROPOSAL_KEX_ALGS]);
|
|
||||||
|
|
||||||
if (options.rekey_limit || options.rekey_interval)
|
|
||||||
packet_set_rekey_limits((u_int32_t)options.rekey_limit,
|
|
||||||
(time_t)options.rekey_interval);
|
|
||||||
|
|
||||||
/* start key exchange */
|
|
||||||
kex = kex_setup(myproposal);
|
|
||||||
kex->kex[KEX_DH_GRP1_SHA1] = kexdh_client;
|
|
||||||
diff --git a/openssh-6.6p1/sshd.c b/openssh-6.6p1/sshd.c
|
|
||||||
--- a/openssh-6.6p1/sshd.c
|
|
||||||
+++ b/openssh-6.6p1/sshd.c
|
|
||||||
@@ -2457,16 +2457,19 @@ do_ssh2_kex(void)
|
|
||||||
myproposal[PROPOSAL_COMP_ALGS_STOC] = "none";
|
|
||||||
} else if (options.compression == COMP_DELAYED) {
|
|
||||||
myproposal[PROPOSAL_COMP_ALGS_CTOS] =
|
|
||||||
myproposal[PROPOSAL_COMP_ALGS_STOC] = "none,zlib@openssh.com";
|
|
||||||
}
|
|
||||||
if (options.kex_algorithms != NULL)
|
|
||||||
myproposal[PROPOSAL_KEX_ALGS] = options.kex_algorithms;
|
|
||||||
|
|
||||||
+ myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(
|
|
||||||
+ myproposal[PROPOSAL_KEX_ALGS]);
|
|
||||||
+
|
|
||||||
if (options.rekey_limit || options.rekey_interval)
|
|
||||||
packet_set_rekey_limits((u_int32_t)options.rekey_limit,
|
|
||||||
(time_t)options.rekey_interval);
|
|
||||||
|
|
||||||
myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = compat_pkalg_proposal(
|
|
||||||
list_hostkey_types());
|
|
||||||
|
|
||||||
/* start key exchange */
|
|
||||||
diff --git a/openssh-6.6p1/version.h b/openssh-6.6p1/version.h
|
|
||||||
--- a/openssh-6.6p1/version.h
|
|
||||||
+++ b/openssh-6.6p1/version.h
|
|
||||||
@@ -1,6 +1,6 @@
|
|
||||||
/* $OpenBSD: version.h,v 1.70 2014/02/27 22:57:40 djm Exp $ */
|
|
||||||
|
|
||||||
-#define SSH_VERSION "OpenSSH_6.6"
|
|
||||||
+#define SSH_VERSION "OpenSSH_6.6.1"
|
|
||||||
|
|
||||||
#define SSH_PORTABLE "p1"
|
|
||||||
#define SSH_RELEASE SSH_VERSION SSH_PORTABLE
|
|
@ -1,24 +0,0 @@
|
|||||||
# only enable SSHv2 protocol by default (upstream default is fallback to v1)
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/ssh_config b/openssh-6.6p1/ssh_config
|
|
||||||
--- a/openssh-6.6p1/ssh_config
|
|
||||||
+++ b/openssh-6.6p1/ssh_config
|
|
||||||
@@ -41,17 +41,17 @@ ForwardX11Trusted yes
|
|
||||||
# CheckHostIP yes
|
|
||||||
# AddressFamily any
|
|
||||||
# ConnectTimeout 0
|
|
||||||
# StrictHostKeyChecking ask
|
|
||||||
# IdentityFile ~/.ssh/identity
|
|
||||||
# IdentityFile ~/.ssh/id_rsa
|
|
||||||
# IdentityFile ~/.ssh/id_dsa
|
|
||||||
# Port 22
|
|
||||||
-# Protocol 2,1
|
|
||||||
+Protocol 2
|
|
||||||
# Cipher 3des
|
|
||||||
# Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc
|
|
||||||
# MACs hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160
|
|
||||||
# EscapeChar ~
|
|
||||||
# Tunnel no
|
|
||||||
# TunnelDevice any:any
|
|
||||||
# PermitLocalCommand no
|
|
||||||
# VisualHostKey no
|
|
@ -1,32 +0,0 @@
|
|||||||
# disable run-time check for OpenSSL ABI by version number as that is not a
|
|
||||||
# reliable indicator of ABI changes and doesn't make much sense in a
|
|
||||||
# distribution package
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/entropy.c b/openssh-6.6p1/entropy.c
|
|
||||||
--- a/openssh-6.6p1/entropy.c
|
|
||||||
+++ b/openssh-6.6p1/entropy.c
|
|
||||||
@@ -212,22 +212,23 @@ seed_rng(void)
|
|
||||||
#endif
|
|
||||||
/*
|
|
||||||
* OpenSSL version numbers: MNNFFPPS: major minor fix patch status
|
|
||||||
* We match major, minor, fix and status (not patch) for <1.0.0.
|
|
||||||
* After that, we acceptable compatible fix versions (so we
|
|
||||||
* allow 1.0.1 to work with 1.0.0). Going backwards is only allowed
|
|
||||||
* within a patch series.
|
|
||||||
*/
|
|
||||||
+#if 0
|
|
||||||
u_long version_mask = SSLeay() >= 0x1000000f ? ~0xffff0L : ~0xff0L;
|
|
||||||
if (((SSLeay() ^ OPENSSL_VERSION_NUMBER) & version_mask) ||
|
|
||||||
(SSLeay() >> 12) < (OPENSSL_VERSION_NUMBER >> 12))
|
|
||||||
fatal("OpenSSL version mismatch. Built against %lx, you "
|
|
||||||
"have %lx", (u_long)OPENSSL_VERSION_NUMBER, SSLeay());
|
|
||||||
-
|
|
||||||
+#endif
|
|
||||||
#ifndef OPENSSL_PRNG_ONLY
|
|
||||||
if (RAND_status() == 1) {
|
|
||||||
debug3("RNG is ready, skipping seeding");
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (seed_from_prngd(buf, sizeof(buf)) == -1)
|
|
||||||
fatal("Could not obtain seed from PRNGd");
|
|
@ -1,730 +0,0 @@
|
|||||||
# HG changeset patch
|
|
||||||
# Parent 8b2615db484b7061edd15f3bee36958f790f790e
|
|
||||||
|
|
||||||
# select fingerprint hash algorithms based on the environment variable
|
|
||||||
# SSH_FP_TYPE_ENVVAR and append it to hex and randomart fingerprints
|
|
||||||
# Petr Cerny <pcerny@suse.cz>
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/auth-rsa.c b/openssh-6.6p1/auth-rsa.c
|
|
||||||
--- a/openssh-6.6p1/auth-rsa.c
|
|
||||||
+++ b/openssh-6.6p1/auth-rsa.c
|
|
||||||
@@ -230,17 +230,17 @@ rsa_key_allowed_in_file(struct passwd *p
|
|
||||||
|
|
||||||
/* check the real bits */
|
|
||||||
keybits = BN_num_bits(key->rsa->n);
|
|
||||||
if (keybits < 0 || bits != keybits)
|
|
||||||
logit("Warning: %s, line %lu: keysize mismatch: "
|
|
||||||
"actual %d vs. announced %d.",
|
|
||||||
file, linenum, BN_num_bits(key->rsa->n), bits);
|
|
||||||
|
|
||||||
- fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
|
|
||||||
+ fp = key_fingerprint(key, key_fp_type_select(), SSH_FP_HEX);
|
|
||||||
debug("matching key found: file %s, line %lu %s %s",
|
|
||||||
file, linenum, key_type(key), fp);
|
|
||||||
free(fp);
|
|
||||||
|
|
||||||
/* Never accept a revoked key */
|
|
||||||
if (auth_key_is_revoked(key))
|
|
||||||
break;
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/auth.c b/openssh-6.6p1/auth.c
|
|
||||||
--- a/openssh-6.6p1/auth.c
|
|
||||||
+++ b/openssh-6.6p1/auth.c
|
|
||||||
@@ -680,17 +680,17 @@ auth_key_is_revoked(Key *key)
|
|
||||||
case -1:
|
|
||||||
/* Error opening revoked_keys_file: refuse all keys */
|
|
||||||
error("Revoked keys file is unreadable: refusing public key "
|
|
||||||
"authentication");
|
|
||||||
return 1;
|
|
||||||
case 1:
|
|
||||||
revoked:
|
|
||||||
/* Key revoked */
|
|
||||||
- key_fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
|
|
||||||
+ key_fp = key_fingerprint(key, key_fp_type_select(), SSH_FP_HEX);
|
|
||||||
error("WARNING: authentication attempt with a revoked "
|
|
||||||
"%s key %s ", key_type(key), key_fp);
|
|
||||||
free(key_fp);
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
fatal("key_in_file returned junk");
|
|
||||||
}
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/auth2-hostbased.c b/openssh-6.6p1/auth2-hostbased.c
|
|
||||||
--- a/openssh-6.6p1/auth2-hostbased.c
|
|
||||||
+++ b/openssh-6.6p1/auth2-hostbased.c
|
|
||||||
@@ -202,23 +202,23 @@ hostbased_key_allowed(struct passwd *pw,
|
|
||||||
_PATH_SSH_SYSTEM_HOSTFILE2,
|
|
||||||
options.ignore_user_known_hosts ? NULL :
|
|
||||||
_PATH_SSH_USER_HOSTFILE2);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (host_status == HOST_OK) {
|
|
||||||
if (key_is_cert(key)) {
|
|
||||||
fp = key_fingerprint(key->cert->signature_key,
|
|
||||||
- SSH_FP_MD5, SSH_FP_HEX);
|
|
||||||
+ key_fp_type_select(), SSH_FP_HEX);
|
|
||||||
verbose("Accepted certificate ID \"%s\" signed by "
|
|
||||||
"%s CA %s from %s@%s", key->cert->key_id,
|
|
||||||
key_type(key->cert->signature_key), fp,
|
|
||||||
cuser, lookup);
|
|
||||||
} else {
|
|
||||||
- fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
|
|
||||||
+ fp = key_fingerprint(key, key_fp_type_select(), SSH_FP_HEX);
|
|
||||||
verbose("Accepted %s public key %s from %s@%s",
|
|
||||||
key_type(key), fp, cuser, lookup);
|
|
||||||
}
|
|
||||||
free(fp);
|
|
||||||
}
|
|
||||||
|
|
||||||
return (host_status == HOST_OK);
|
|
||||||
}
|
|
||||||
diff --git a/openssh-6.6p1/auth2-pubkey.c b/openssh-6.6p1/auth2-pubkey.c
|
|
||||||
--- a/openssh-6.6p1/auth2-pubkey.c
|
|
||||||
+++ b/openssh-6.6p1/auth2-pubkey.c
|
|
||||||
@@ -208,25 +208,25 @@ pubkey_auth_info(Authctxt *authctxt, con
|
|
||||||
i = vasprintf(&extra, fmt, ap);
|
|
||||||
va_end(ap);
|
|
||||||
if (i < 0 || extra == NULL)
|
|
||||||
fatal("%s: vasprintf failed", __func__);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (key_is_cert(key)) {
|
|
||||||
fp = key_fingerprint(key->cert->signature_key,
|
|
||||||
- SSH_FP_MD5, SSH_FP_HEX);
|
|
||||||
+ key_fp_type_select(), SSH_FP_HEX);
|
|
||||||
auth_info(authctxt, "%s ID %s (serial %llu) CA %s %s%s%s",
|
|
||||||
key_type(key), key->cert->key_id,
|
|
||||||
(unsigned long long)key->cert->serial,
|
|
||||||
key_type(key->cert->signature_key), fp,
|
|
||||||
extra == NULL ? "" : ", ", extra == NULL ? "" : extra);
|
|
||||||
free(fp);
|
|
||||||
} else {
|
|
||||||
- fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
|
|
||||||
+ fp = key_fingerprint(key, key_fp_type_select(), SSH_FP_HEX);
|
|
||||||
auth_info(authctxt, "%s %s%s%s", key_type(key), fp,
|
|
||||||
extra == NULL ? "" : ", ", extra == NULL ? "" : extra);
|
|
||||||
free(fp);
|
|
||||||
}
|
|
||||||
free(extra);
|
|
||||||
}
|
|
||||||
|
|
||||||
static int
|
|
||||||
@@ -360,17 +360,17 @@ check_authkeys_file(FILE *f, char *file,
|
|
||||||
if (key_is_cert(key)) {
|
|
||||||
if (!key_equal(found, key->cert->signature_key))
|
|
||||||
continue;
|
|
||||||
if (auth_parse_options(pw, key_options, file,
|
|
||||||
linenum) != 1)
|
|
||||||
continue;
|
|
||||||
if (!key_is_cert_authority)
|
|
||||||
continue;
|
|
||||||
- fp = key_fingerprint(found, SSH_FP_MD5,
|
|
||||||
+ fp = key_fingerprint(found, key_fp_type_select(),
|
|
||||||
SSH_FP_HEX);
|
|
||||||
debug("matching CA found: file %s, line %lu, %s %s",
|
|
||||||
file, linenum, key_type(found), fp);
|
|
||||||
/*
|
|
||||||
* If the user has specified a list of principals as
|
|
||||||
* a key option, then prefer that list to matching
|
|
||||||
* their username in the certificate principals list.
|
|
||||||
*/
|
|
||||||
@@ -401,17 +401,17 @@ check_authkeys_file(FILE *f, char *file,
|
|
||||||
break;
|
|
||||||
} else if (key_equal(found, key)) {
|
|
||||||
if (auth_parse_options(pw, key_options, file,
|
|
||||||
linenum) != 1)
|
|
||||||
continue;
|
|
||||||
if (key_is_cert_authority)
|
|
||||||
continue;
|
|
||||||
found_key = 1;
|
|
||||||
- fp = key_fingerprint(found, SSH_FP_MD5, SSH_FP_HEX);
|
|
||||||
+ fp = key_fingerprint(found, key_fp_type_select(), SSH_FP_HEX);
|
|
||||||
debug("matching key found: file %s, line %lu %s %s",
|
|
||||||
file, linenum, key_type(found), fp);
|
|
||||||
free(fp);
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (found != NULL)
|
|
||||||
key_free(found);
|
|
||||||
@@ -427,17 +427,17 @@ user_cert_trusted_ca(struct passwd *pw,
|
|
||||||
char *ca_fp, *principals_file = NULL;
|
|
||||||
const char *reason;
|
|
||||||
int ret = 0;
|
|
||||||
|
|
||||||
if (!key_is_cert(key) || options.trusted_user_ca_keys == NULL)
|
|
||||||
return 0;
|
|
||||||
|
|
||||||
ca_fp = key_fingerprint(key->cert->signature_key,
|
|
||||||
- SSH_FP_MD5, SSH_FP_HEX);
|
|
||||||
+ key_fp_type_select(), SSH_FP_HEX);
|
|
||||||
|
|
||||||
if (key_in_file(key->cert->signature_key,
|
|
||||||
options.trusted_user_ca_keys, 1) != 1) {
|
|
||||||
debug2("%s: CA %s %s is not listed in %s", __func__,
|
|
||||||
key_type(key->cert->signature_key), ca_fp,
|
|
||||||
options.trusted_user_ca_keys);
|
|
||||||
goto out;
|
|
||||||
}
|
|
||||||
diff --git a/openssh-6.6p1/key.c b/openssh-6.6p1/key.c
|
|
||||||
--- a/openssh-6.6p1/key.c
|
|
||||||
+++ b/openssh-6.6p1/key.c
|
|
||||||
@@ -420,30 +420,39 @@ key_fingerprint_raw(const Key *k, enum f
|
|
||||||
*dgst_raw_length = ssh_digest_bytes(hash_alg);
|
|
||||||
} else {
|
|
||||||
fatal("%s: blob is null", __func__);
|
|
||||||
}
|
|
||||||
return retval;
|
|
||||||
}
|
|
||||||
|
|
||||||
static char *
|
|
||||||
-key_fingerprint_hex(u_char *dgst_raw, u_int dgst_raw_len)
|
|
||||||
+key_fingerprint_hex(u_char *dgst_raw, u_int dgst_raw_len, enum fp_type dgst_type)
|
|
||||||
{
|
|
||||||
char *retval;
|
|
||||||
u_int i;
|
|
||||||
|
|
||||||
- retval = xcalloc(1, dgst_raw_len * 3 + 1);
|
|
||||||
+ /* reserve space for both the key hash and the string for the hash type */
|
|
||||||
+ retval = xcalloc(1, dgst_raw_len * 3 + 1 + SSH_FP_TYPE_STRLEN + 2);
|
|
||||||
for (i = 0; i < dgst_raw_len; i++) {
|
|
||||||
char hex[4];
|
|
||||||
snprintf(hex, sizeof(hex), "%02x:", dgst_raw[i]);
|
|
||||||
strlcat(retval, hex, dgst_raw_len * 3 + 1);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* Remove the trailing ':' character */
|
|
||||||
- retval[(dgst_raw_len * 3) - 1] = '\0';
|
|
||||||
+ retval[(dgst_raw_len * 3) - 1] = ' ';
|
|
||||||
+
|
|
||||||
+ /* Append hash type */
|
|
||||||
+ {
|
|
||||||
+ char hash[SSH_FP_TYPE_STRLEN + 2 + 1];
|
|
||||||
+ snprintf(hash, sizeof(hash), "[%s]", key_fp_type_str(dgst_type));
|
|
||||||
+ strlcat(retval, hash, dgst_raw_len * 3 + 1 + SSH_FP_TYPE_STRLEN + 2);
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
return retval;
|
|
||||||
}
|
|
||||||
|
|
||||||
static char *
|
|
||||||
key_fingerprint_bubblebabble(u_char *dgst_raw, u_int dgst_raw_len)
|
|
||||||
{
|
|
||||||
char vowels[] = { 'a', 'e', 'i', 'o', 'u', 'y' };
|
|
||||||
char consonants[] = { 'b', 'c', 'd', 'f', 'g', 'h', 'k', 'l', 'm',
|
|
||||||
@@ -518,17 +527,18 @@ key_fingerprint_bubblebabble(u_char *dgs
|
|
||||||
* can be in the exact middle of the picture, and FLDBASE should be >=8 .
|
|
||||||
* Else pictures would be too dense, and drawing the frame would
|
|
||||||
* fail, too, because the key type would not fit in anymore.
|
|
||||||
*/
|
|
||||||
#define FLDBASE 8
|
|
||||||
#define FLDSIZE_Y (FLDBASE + 1)
|
|
||||||
#define FLDSIZE_X (FLDBASE * 2 + 1)
|
|
||||||
static char *
|
|
||||||
-key_fingerprint_randomart(u_char *dgst_raw, u_int dgst_raw_len, const Key *k)
|
|
||||||
+key_fingerprint_randomart(u_char *dgst_raw, u_int dgst_raw_len, const Key *k,
|
|
||||||
+ enum fp_type dgst_type)
|
|
||||||
{
|
|
||||||
/*
|
|
||||||
* Chars to be used after each other every time the worm
|
|
||||||
* intersects with itself. Matter of taste.
|
|
||||||
*/
|
|
||||||
char *augmentation_string = " .o+=*BOX@%&#/^SE";
|
|
||||||
char *retval, *p;
|
|
||||||
u_char field[FLDSIZE_X][FLDSIZE_Y];
|
|
||||||
@@ -585,18 +595,19 @@ key_fingerprint_randomart(u_char *dgst_r
|
|
||||||
*p++ = '|';
|
|
||||||
for (x = 0; x < FLDSIZE_X; x++)
|
|
||||||
*p++ = augmentation_string[MIN(field[x][y], len)];
|
|
||||||
*p++ = '|';
|
|
||||||
*p++ = '\n';
|
|
||||||
}
|
|
||||||
|
|
||||||
/* output lower border */
|
|
||||||
- *p++ = '+';
|
|
||||||
- for (i = 0; i < FLDSIZE_X; i++)
|
|
||||||
+ i = snprintf(p, FLDSIZE_X, "+--[%s]", key_fp_type_str(dgst_type));
|
|
||||||
+ p += i;
|
|
||||||
+ for (i--; i < FLDSIZE_X; i++)
|
|
||||||
*p++ = '-';
|
|
||||||
*p++ = '+';
|
|
||||||
|
|
||||||
return retval;
|
|
||||||
}
|
|
||||||
|
|
||||||
char *
|
|
||||||
key_fingerprint(const Key *k, enum fp_type dgst_type, enum fp_rep dgst_rep)
|
|
||||||
@@ -605,34 +616,91 @@ key_fingerprint(const Key *k, enum fp_ty
|
|
||||||
u_char *dgst_raw;
|
|
||||||
u_int dgst_raw_len;
|
|
||||||
|
|
||||||
dgst_raw = key_fingerprint_raw(k, dgst_type, &dgst_raw_len);
|
|
||||||
if (!dgst_raw)
|
|
||||||
fatal("key_fingerprint: null from key_fingerprint_raw()");
|
|
||||||
switch (dgst_rep) {
|
|
||||||
case SSH_FP_HEX:
|
|
||||||
- retval = key_fingerprint_hex(dgst_raw, dgst_raw_len);
|
|
||||||
+ retval = key_fingerprint_hex(dgst_raw, dgst_raw_len, dgst_type);
|
|
||||||
break;
|
|
||||||
case SSH_FP_BUBBLEBABBLE:
|
|
||||||
retval = key_fingerprint_bubblebabble(dgst_raw, dgst_raw_len);
|
|
||||||
break;
|
|
||||||
case SSH_FP_RANDOMART:
|
|
||||||
- retval = key_fingerprint_randomart(dgst_raw, dgst_raw_len, k);
|
|
||||||
+ retval = key_fingerprint_randomart(dgst_raw, dgst_raw_len, k, dgst_type);
|
|
||||||
break;
|
|
||||||
default:
|
|
||||||
fatal("key_fingerprint: bad digest representation %d",
|
|
||||||
dgst_rep);
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
explicit_bzero(dgst_raw, dgst_raw_len);
|
|
||||||
free(dgst_raw);
|
|
||||||
return retval;
|
|
||||||
}
|
|
||||||
|
|
||||||
+enum fp_type
|
|
||||||
+key_fp_type_select(void)
|
|
||||||
+{
|
|
||||||
+ static enum fp_type fp;
|
|
||||||
+ static char fp_defined = 0;
|
|
||||||
+ char *env;
|
|
||||||
+
|
|
||||||
+ if (!fp_defined) {
|
|
||||||
+ env = getenv(SSH_FP_TYPE_ENVVAR);
|
|
||||||
+ if (env) {
|
|
||||||
+ if (!strcasecmp(env, "md5") ||
|
|
||||||
+ !strcasecmp(env, "md-5"))
|
|
||||||
+ fp = SSH_FP_MD5;
|
|
||||||
+ else if (!strcasecmp(env, "sha1") ||
|
|
||||||
+ !strcasecmp(env, "sha-1"))
|
|
||||||
+ fp = SSH_FP_SHA1;
|
|
||||||
+#ifdef HAVE_EVP_SHA256
|
|
||||||
+ else if (!strcasecmp(env, "sha256") ||
|
|
||||||
+ !strcasecmp(env, "sha-256"))
|
|
||||||
+ fp = SSH_FP_SHA256;
|
|
||||||
+#endif
|
|
||||||
+ else {
|
|
||||||
+ error("invalid key type in environment variable "
|
|
||||||
+ SSH_FP_TYPE_ENVVAR ": '%s' - falling back to MD5.",
|
|
||||||
+ env);
|
|
||||||
+ fp = SSH_FP_MD5;
|
|
||||||
+ }
|
|
||||||
+ } else
|
|
||||||
+ fp = SSH_FP_MD5;
|
|
||||||
+
|
|
||||||
+ fp_defined = 1;
|
|
||||||
+ }
|
|
||||||
+ return fp;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+/*
|
|
||||||
+ * string lengths must be less or equal to SSH_FP_TYPE_STRLEN (defined in
|
|
||||||
+ * key.h) as to fit into the fingerprint string buffer
|
|
||||||
+ */
|
|
||||||
+char *
|
|
||||||
+key_fp_type_str(enum fp_type dgst_type)
|
|
||||||
+{
|
|
||||||
+ switch (dgst_type) {
|
|
||||||
+ case SSH_FP_MD5:
|
|
||||||
+ return "MD5";
|
|
||||||
+ case SSH_FP_SHA1:
|
|
||||||
+ return "SHA-1";
|
|
||||||
+#ifdef HAVE_EVP_SHA256
|
|
||||||
+ case SSH_FP_SHA256:
|
|
||||||
+ return "SHA-256";
|
|
||||||
+#endif
|
|
||||||
+ default:
|
|
||||||
+ fatal("%s: unknown key fingerprint hash algorithm requested", __func__);
|
|
||||||
+ }
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+
|
|
||||||
/*
|
|
||||||
* Reads a multiple-precision integer in decimal from the buffer, and advances
|
|
||||||
* the pointer. The integer must already be initialized. This function is
|
|
||||||
* permitted to modify the buffer. This leaves *cpp to point just beyond the
|
|
||||||
* last processed (and maybe modified) character. Note that this may modify
|
|
||||||
* the buffer containing the number.
|
|
||||||
*/
|
|
||||||
static int
|
|
||||||
diff --git a/openssh-6.6p1/key.h b/openssh-6.6p1/key.h
|
|
||||||
--- a/openssh-6.6p1/key.h
|
|
||||||
+++ b/openssh-6.6p1/key.h
|
|
||||||
@@ -53,16 +53,18 @@ enum fp_type {
|
|
||||||
SSH_FP_MD5,
|
|
||||||
SSH_FP_SHA256
|
|
||||||
};
|
|
||||||
enum fp_rep {
|
|
||||||
SSH_FP_HEX,
|
|
||||||
SSH_FP_BUBBLEBABBLE,
|
|
||||||
SSH_FP_RANDOMART
|
|
||||||
};
|
|
||||||
+#define SSH_FP_TYPE_ENVVAR "SSH_FINGERPRINT_TYPE"
|
|
||||||
+#define SSH_FP_TYPE_STRLEN 8
|
|
||||||
|
|
||||||
/* key is stored in external hardware */
|
|
||||||
#define KEY_FLAG_EXT 0x0001
|
|
||||||
|
|
||||||
#define CERT_MAX_PRINCIPALS 256
|
|
||||||
struct KeyCert {
|
|
||||||
Buffer certblob; /* Kept around for use on wire */
|
|
||||||
u_int type; /* SSH2_CERT_TYPE_USER or SSH2_CERT_TYPE_HOST */
|
|
||||||
@@ -104,16 +106,18 @@ int key_equal_public(const Key *, cons
|
|
||||||
int key_equal(const Key *, const Key *);
|
|
||||||
char *key_fingerprint(const Key *, enum fp_type, enum fp_rep);
|
|
||||||
u_char *key_fingerprint_raw(const Key *, enum fp_type, u_int *);
|
|
||||||
const char *key_type(const Key *);
|
|
||||||
const char *key_cert_type(const Key *);
|
|
||||||
int key_write(const Key *, FILE *);
|
|
||||||
int key_read(Key *, char **);
|
|
||||||
u_int key_size(const Key *);
|
|
||||||
+enum fp_type key_fp_type_select(void);
|
|
||||||
+char *key_fp_type_str(enum fp_type);
|
|
||||||
|
|
||||||
Key *key_generate(int, u_int);
|
|
||||||
Key *key_from_private(const Key *);
|
|
||||||
int key_type_from_name(char *);
|
|
||||||
int key_is_cert(const Key *);
|
|
||||||
int key_type_is_cert(int);
|
|
||||||
int key_type_plain(int);
|
|
||||||
int key_to_certified(Key *, int);
|
|
||||||
diff --git a/openssh-6.6p1/ssh-add.c b/openssh-6.6p1/ssh-add.c
|
|
||||||
--- a/openssh-6.6p1/ssh-add.c
|
|
||||||
+++ b/openssh-6.6p1/ssh-add.c
|
|
||||||
@@ -325,17 +325,17 @@ list_identities(AuthenticationConnection
|
|
||||||
int version;
|
|
||||||
|
|
||||||
for (version = 1; version <= 2; version++) {
|
|
||||||
for (key = ssh_get_first_identity(ac, &comment, version);
|
|
||||||
key != NULL;
|
|
||||||
key = ssh_get_next_identity(ac, &comment, version)) {
|
|
||||||
had_identities = 1;
|
|
||||||
if (do_fp) {
|
|
||||||
- fp = key_fingerprint(key, SSH_FP_MD5,
|
|
||||||
+ fp = key_fingerprint(key, key_fp_type_select(),
|
|
||||||
SSH_FP_HEX);
|
|
||||||
printf("%d %s %s (%s)\n",
|
|
||||||
key_size(key), fp, comment, key_type(key));
|
|
||||||
free(fp);
|
|
||||||
} else {
|
|
||||||
if (!key_write(key, stdout))
|
|
||||||
fprintf(stderr, "key_write failed");
|
|
||||||
fprintf(stdout, " %s\n", comment);
|
|
||||||
diff --git a/openssh-6.6p1/ssh-agent.c b/openssh-6.6p1/ssh-agent.c
|
|
||||||
--- a/openssh-6.6p1/ssh-agent.c
|
|
||||||
+++ b/openssh-6.6p1/ssh-agent.c
|
|
||||||
@@ -193,17 +193,17 @@ lookup_identity(Key *key, int version)
|
|
||||||
|
|
||||||
/* Check confirmation of keysign request */
|
|
||||||
static int
|
|
||||||
confirm_key(Identity *id)
|
|
||||||
{
|
|
||||||
char *p;
|
|
||||||
int ret = -1;
|
|
||||||
|
|
||||||
- p = key_fingerprint(id->key, SSH_FP_MD5, SSH_FP_HEX);
|
|
||||||
+ p = key_fingerprint(id->key, key_fp_type_select(), SSH_FP_HEX);
|
|
||||||
if (ask_permission("Allow use of key %s?\nKey fingerprint %s.",
|
|
||||||
id->comment, p))
|
|
||||||
ret = 0;
|
|
||||||
free(p);
|
|
||||||
|
|
||||||
return (ret);
|
|
||||||
}
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/ssh-keygen.c b/openssh-6.6p1/ssh-keygen.c
|
|
||||||
--- a/openssh-6.6p1/ssh-keygen.c
|
|
||||||
+++ b/openssh-6.6p1/ssh-keygen.c
|
|
||||||
@@ -741,27 +741,27 @@ do_download(struct passwd *pw)
|
|
||||||
{
|
|
||||||
#ifdef ENABLE_PKCS11
|
|
||||||
Key **keys = NULL;
|
|
||||||
int i, nkeys;
|
|
||||||
enum fp_rep rep;
|
|
||||||
enum fp_type fptype;
|
|
||||||
char *fp, *ra;
|
|
||||||
|
|
||||||
- fptype = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5;
|
|
||||||
+ fptype = print_bubblebabble ? SSH_FP_SHA1 : key_fp_type_select();
|
|
||||||
rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX;
|
|
||||||
|
|
||||||
pkcs11_init(0);
|
|
||||||
nkeys = pkcs11_add_provider(pkcs11provider, NULL, &keys);
|
|
||||||
if (nkeys <= 0)
|
|
||||||
fatal("cannot read public key from pkcs11");
|
|
||||||
for (i = 0; i < nkeys; i++) {
|
|
||||||
if (print_fingerprint) {
|
|
||||||
fp = key_fingerprint(keys[i], fptype, rep);
|
|
||||||
- ra = key_fingerprint(keys[i], SSH_FP_MD5,
|
|
||||||
+ ra = key_fingerprint(keys[i], key_fp_type_select(),
|
|
||||||
SSH_FP_RANDOMART);
|
|
||||||
printf("%u %s %s (PKCS11 key)\n", key_size(keys[i]),
|
|
||||||
fp, key_type(keys[i]));
|
|
||||||
if (log_level >= SYSLOG_LEVEL_VERBOSE)
|
|
||||||
printf("%s\n", ra);
|
|
||||||
free(ra);
|
|
||||||
free(fp);
|
|
||||||
} else {
|
|
||||||
@@ -784,29 +784,29 @@ do_fingerprint(struct passwd *pw)
|
|
||||||
FILE *f;
|
|
||||||
Key *public;
|
|
||||||
char *comment = NULL, *cp, *ep, line[16*1024], *fp, *ra;
|
|
||||||
int i, skip = 0, num = 0, invalid = 1;
|
|
||||||
enum fp_rep rep;
|
|
||||||
enum fp_type fptype;
|
|
||||||
struct stat st;
|
|
||||||
|
|
||||||
- fptype = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5;
|
|
||||||
+ fptype = print_bubblebabble ? SSH_FP_SHA1 : key_fp_type_select();
|
|
||||||
rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX;
|
|
||||||
|
|
||||||
if (!have_identity)
|
|
||||||
ask_filename(pw, "Enter file in which the key is");
|
|
||||||
if (stat(identity_file, &st) < 0) {
|
|
||||||
perror(identity_file);
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
public = key_load_public(identity_file, &comment);
|
|
||||||
if (public != NULL) {
|
|
||||||
fp = key_fingerprint(public, fptype, rep);
|
|
||||||
- ra = key_fingerprint(public, SSH_FP_MD5, SSH_FP_RANDOMART);
|
|
||||||
+ ra = key_fingerprint(public, key_fp_type_select(), SSH_FP_RANDOMART);
|
|
||||||
printf("%u %s %s (%s)\n", key_size(public), fp, comment,
|
|
||||||
key_type(public));
|
|
||||||
if (log_level >= SYSLOG_LEVEL_VERBOSE)
|
|
||||||
printf("%s\n", ra);
|
|
||||||
key_free(public);
|
|
||||||
free(comment);
|
|
||||||
free(ra);
|
|
||||||
free(fp);
|
|
||||||
@@ -862,17 +862,17 @@ do_fingerprint(struct passwd *pw)
|
|
||||||
public = key_new(KEY_UNSPEC);
|
|
||||||
if (key_read(public, &cp) != 1) {
|
|
||||||
key_free(public);
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
comment = *cp ? cp : comment;
|
|
||||||
fp = key_fingerprint(public, fptype, rep);
|
|
||||||
- ra = key_fingerprint(public, SSH_FP_MD5, SSH_FP_RANDOMART);
|
|
||||||
+ ra = key_fingerprint(public, key_fp_type_select(), SSH_FP_RANDOMART);
|
|
||||||
printf("%u %s %s (%s)\n", key_size(public), fp,
|
|
||||||
comment ? comment : "no comment", key_type(public));
|
|
||||||
if (log_level >= SYSLOG_LEVEL_VERBOSE)
|
|
||||||
printf("%s\n", ra);
|
|
||||||
free(ra);
|
|
||||||
free(fp);
|
|
||||||
key_free(public);
|
|
||||||
invalid = 0;
|
|
||||||
@@ -983,20 +983,20 @@ do_gen_all_hostkeys(struct passwd *pw)
|
|
||||||
static void
|
|
||||||
printhost(FILE *f, const char *name, Key *public, int ca, int hash)
|
|
||||||
{
|
|
||||||
if (print_fingerprint) {
|
|
||||||
enum fp_rep rep;
|
|
||||||
enum fp_type fptype;
|
|
||||||
char *fp, *ra;
|
|
||||||
|
|
||||||
- fptype = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5;
|
|
||||||
+ fptype = print_bubblebabble ? SSH_FP_SHA1 : key_fp_type_select();
|
|
||||||
rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX;
|
|
||||||
fp = key_fingerprint(public, fptype, rep);
|
|
||||||
- ra = key_fingerprint(public, SSH_FP_MD5, SSH_FP_RANDOMART);
|
|
||||||
+ ra = key_fingerprint(public, key_fp_type_select(), SSH_FP_RANDOMART);
|
|
||||||
printf("%u %s %s (%s)\n", key_size(public), fp, name,
|
|
||||||
key_type(public));
|
|
||||||
if (log_level >= SYSLOG_LEVEL_VERBOSE)
|
|
||||||
printf("%s\n", ra);
|
|
||||||
free(ra);
|
|
||||||
free(fp);
|
|
||||||
} else {
|
|
||||||
if (hash && (name = host_hash(name, NULL, 0)) == NULL)
|
|
||||||
@@ -1873,19 +1873,19 @@ do_show_cert(struct passwd *pw)
|
|
||||||
if (stat(identity_file, &st) < 0)
|
|
||||||
fatal("%s: %s: %s", __progname, identity_file, strerror(errno));
|
|
||||||
if ((key = key_load_public(identity_file, NULL)) == NULL)
|
|
||||||
fatal("%s is not a public key", identity_file);
|
|
||||||
if (!key_is_cert(key))
|
|
||||||
fatal("%s is not a certificate", identity_file);
|
|
||||||
v00 = key->type == KEY_RSA_CERT_V00 || key->type == KEY_DSA_CERT_V00;
|
|
||||||
|
|
||||||
- key_fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
|
|
||||||
+ key_fp = key_fingerprint(key, key_fp_type_select(), SSH_FP_HEX);
|
|
||||||
ca_fp = key_fingerprint(key->cert->signature_key,
|
|
||||||
- SSH_FP_MD5, SSH_FP_HEX);
|
|
||||||
+ key_fp_type_select(), SSH_FP_HEX);
|
|
||||||
|
|
||||||
printf("%s:\n", identity_file);
|
|
||||||
printf(" Type: %s %s certificate\n", key_ssh_name(key),
|
|
||||||
key_cert_type(key));
|
|
||||||
printf(" Public key: %s %s\n", key_type(key), key_fp);
|
|
||||||
printf(" Signing CA: %s %s\n",
|
|
||||||
key_type(key->cert->signature_key), ca_fp);
|
|
||||||
printf(" Key ID: \"%s\"\n", key->cert->key_id);
|
|
||||||
@@ -2681,18 +2681,18 @@ passphrase_again:
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
if (!key_write(public, f))
|
|
||||||
fprintf(stderr, "write key failed\n");
|
|
||||||
fprintf(f, " %s\n", comment);
|
|
||||||
fclose(f);
|
|
||||||
|
|
||||||
if (!quiet) {
|
|
||||||
- char *fp = key_fingerprint(public, SSH_FP_MD5, SSH_FP_HEX);
|
|
||||||
- char *ra = key_fingerprint(public, SSH_FP_MD5,
|
|
||||||
+ char *fp = key_fingerprint(public, key_fp_type_select(), SSH_FP_HEX);
|
|
||||||
+ char *ra = key_fingerprint(public, key_fp_type_select(),
|
|
||||||
SSH_FP_RANDOMART);
|
|
||||||
printf("Your public key has been saved in %s.\n",
|
|
||||||
identity_file);
|
|
||||||
printf("The key fingerprint is:\n");
|
|
||||||
printf("%s %s\n", fp, comment);
|
|
||||||
printf("The key's randomart image is:\n");
|
|
||||||
printf("%s\n", ra);
|
|
||||||
free(ra);
|
|
||||||
diff --git a/openssh-6.6p1/sshconnect.c b/openssh-6.6p1/sshconnect.c
|
|
||||||
--- a/openssh-6.6p1/sshconnect.c
|
|
||||||
+++ b/openssh-6.6p1/sshconnect.c
|
|
||||||
@@ -909,18 +909,18 @@ check_host_key(char *hostname, struct so
|
|
||||||
"address '%.128s' to the list of known "
|
|
||||||
"hosts (%.30s).", type, ip,
|
|
||||||
user_hostfiles[0]);
|
|
||||||
else
|
|
||||||
logit("Warning: Permanently added the %s host "
|
|
||||||
"key for IP address '%.128s' to the list "
|
|
||||||
"of known hosts.", type, ip);
|
|
||||||
} else if (options.visual_host_key) {
|
|
||||||
- fp = key_fingerprint(host_key, SSH_FP_MD5, SSH_FP_HEX);
|
|
||||||
- ra = key_fingerprint(host_key, SSH_FP_MD5,
|
|
||||||
+ fp = key_fingerprint(host_key, key_fp_type_select(), SSH_FP_HEX);
|
|
||||||
+ ra = key_fingerprint(host_key, key_fp_type_select(),
|
|
||||||
SSH_FP_RANDOMART);
|
|
||||||
logit("Host key fingerprint is %s\n%s\n", fp, ra);
|
|
||||||
free(ra);
|
|
||||||
free(fp);
|
|
||||||
}
|
|
||||||
break;
|
|
||||||
case HOST_NEW:
|
|
||||||
if (options.host_key_alias == NULL && port != 0 &&
|
|
||||||
@@ -950,18 +950,18 @@ check_host_key(char *hostname, struct so
|
|
||||||
|
|
||||||
if (show_other_keys(host_hostkeys, host_key))
|
|
||||||
snprintf(msg1, sizeof(msg1),
|
|
||||||
"\nbut keys of different type are already"
|
|
||||||
" known for this host.");
|
|
||||||
else
|
|
||||||
snprintf(msg1, sizeof(msg1), ".");
|
|
||||||
/* The default */
|
|
||||||
- fp = key_fingerprint(host_key, SSH_FP_MD5, SSH_FP_HEX);
|
|
||||||
- ra = key_fingerprint(host_key, SSH_FP_MD5,
|
|
||||||
+ fp = key_fingerprint(host_key, key_fp_type_select(), SSH_FP_HEX);
|
|
||||||
+ ra = key_fingerprint(host_key, key_fp_type_select(),
|
|
||||||
SSH_FP_RANDOMART);
|
|
||||||
msg2[0] = '\0';
|
|
||||||
if (options.verify_host_key_dns) {
|
|
||||||
if (matching_host_key_dns)
|
|
||||||
snprintf(msg2, sizeof(msg2),
|
|
||||||
"Matching host key fingerprint"
|
|
||||||
" found in DNS.\n");
|
|
||||||
else
|
|
||||||
@@ -1215,17 +1215,17 @@ fail:
|
|
||||||
|
|
||||||
/* returns 0 if key verifies or -1 if key does NOT verify */
|
|
||||||
int
|
|
||||||
verify_host_key(char *host, struct sockaddr *hostaddr, Key *host_key)
|
|
||||||
{
|
|
||||||
int flags = 0;
|
|
||||||
char *fp;
|
|
||||||
|
|
||||||
- fp = key_fingerprint(host_key, SSH_FP_MD5, SSH_FP_HEX);
|
|
||||||
+ fp = key_fingerprint(host_key, key_fp_type_select(), SSH_FP_HEX);
|
|
||||||
debug("Server host key: %s %s", key_type(host_key), fp);
|
|
||||||
free(fp);
|
|
||||||
|
|
||||||
/* XXX certs are not yet supported for DNS */
|
|
||||||
if (!key_is_cert(host_key) && options.verify_host_key_dns &&
|
|
||||||
verify_host_key_dns(host, hostaddr, host_key, &flags) == 0) {
|
|
||||||
if (flags & DNS_VERIFY_FOUND) {
|
|
||||||
|
|
||||||
@@ -1322,18 +1322,18 @@ show_other_keys(struct hostkeys *hostkey
|
|
||||||
char *fp, *ra;
|
|
||||||
const struct hostkey_entry *found;
|
|
||||||
|
|
||||||
for (i = 0; type[i] != -1; i++) {
|
|
||||||
if (type[i] == key->type)
|
|
||||||
continue;
|
|
||||||
if (!lookup_key_in_hostkeys_by_type(hostkeys, type[i], &found))
|
|
||||||
continue;
|
|
||||||
- fp = key_fingerprint(found->key, SSH_FP_MD5, SSH_FP_HEX);
|
|
||||||
- ra = key_fingerprint(found->key, SSH_FP_MD5, SSH_FP_RANDOMART);
|
|
||||||
+ fp = key_fingerprint(found->key, key_fp_type_select(), SSH_FP_HEX);
|
|
||||||
+ ra = key_fingerprint(found->key, key_fp_type_select(), SSH_FP_RANDOMART);
|
|
||||||
logit("WARNING: %s key found for host %s\n"
|
|
||||||
"in %s:%lu\n"
|
|
||||||
"%s key fingerprint %s.",
|
|
||||||
key_type(found->key),
|
|
||||||
found->host, found->file, found->line,
|
|
||||||
key_type(found->key), fp);
|
|
||||||
if (options.visual_host_key)
|
|
||||||
logit("%s", ra);
|
|
||||||
@@ -1344,17 +1344,17 @@ show_other_keys(struct hostkeys *hostkey
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void
|
|
||||||
warn_changed_key(Key *host_key)
|
|
||||||
{
|
|
||||||
char *fp;
|
|
||||||
|
|
||||||
- fp = key_fingerprint(host_key, SSH_FP_MD5, SSH_FP_HEX);
|
|
||||||
+ fp = key_fingerprint(host_key, key_fp_type_select(), SSH_FP_HEX);
|
|
||||||
|
|
||||||
error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
|
|
||||||
error("@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @");
|
|
||||||
error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
|
|
||||||
error("IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!");
|
|
||||||
error("Someone could be eavesdropping on you right now (man-in-the-middle attack)!");
|
|
||||||
error("It is also possible that a host key has just been changed.");
|
|
||||||
error("The fingerprint for the %s key sent by the remote host is\n%s.",
|
|
||||||
diff --git a/openssh-6.6p1/sshconnect2.c b/openssh-6.6p1/sshconnect2.c
|
|
||||||
--- a/openssh-6.6p1/sshconnect2.c
|
|
||||||
+++ b/openssh-6.6p1/sshconnect2.c
|
|
||||||
@@ -579,17 +579,17 @@ input_userauth_pk_ok(int type, u_int32_t
|
|
||||||
goto done;
|
|
||||||
}
|
|
||||||
if (key->type != pktype) {
|
|
||||||
error("input_userauth_pk_ok: type mismatch "
|
|
||||||
"for decoded key (received %d, expected %d)",
|
|
||||||
key->type, pktype);
|
|
||||||
goto done;
|
|
||||||
}
|
|
||||||
- fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
|
|
||||||
+ fp = key_fingerprint(key, key_fp_type_select(), SSH_FP_HEX);
|
|
||||||
debug2("input_userauth_pk_ok: fp %s", fp);
|
|
||||||
free(fp);
|
|
||||||
|
|
||||||
/*
|
|
||||||
* search keys in the reverse order, because last candidate has been
|
|
||||||
* moved to the end of the queue. this also avoids confusion by
|
|
||||||
* duplicate keys
|
|
||||||
*/
|
|
||||||
@@ -990,17 +990,17 @@ sign_and_send_pubkey(Authctxt *authctxt,
|
|
||||||
Buffer b;
|
|
||||||
u_char *blob, *signature;
|
|
||||||
u_int bloblen, slen;
|
|
||||||
u_int skip = 0;
|
|
||||||
int ret = -1;
|
|
||||||
int have_sig = 1;
|
|
||||||
char *fp;
|
|
||||||
|
|
||||||
- fp = key_fingerprint(id->key, SSH_FP_MD5, SSH_FP_HEX);
|
|
||||||
+ fp = key_fingerprint(id->key, key_fp_type_select(), SSH_FP_HEX);
|
|
||||||
debug3("sign_and_send_pubkey: %s %s", key_type(id->key), fp);
|
|
||||||
free(fp);
|
|
||||||
|
|
||||||
if (key_to_blob(id->key, &blob, &bloblen) == 0) {
|
|
||||||
/* we cannot handle this key */
|
|
||||||
debug3("sign_and_send_pubkey: cannot handle key");
|
|
||||||
return 0;
|
|
||||||
}
|
|
@ -1,529 +0,0 @@
|
|||||||
# HG changeset patch
|
|
||||||
# Parent 717873621cf4991164c61caafd9ac07473231f10
|
|
||||||
# Simple implementation of FIPS 140-2 selfchecks. Use OpenSSL to generate and
|
|
||||||
# verify checksums of binaries. Any hash iused in OpenSSH can be used (MD5 would
|
|
||||||
# obviously be a poor choice, since OpenSSL would barf and abort immediately in
|
|
||||||
# FIPS mode). SHA-2 seems to be a reasonable choice.
|
|
||||||
#
|
|
||||||
# The logic of the checks is as follows: decide whether FIPS mode is mandated
|
|
||||||
# (either by checking /proc/sys/crypto/fips_enabled or envoroinment variable
|
|
||||||
# SSH_FORCE_FIPS. In FIPS mode, checksums are required to match (inability to
|
|
||||||
# retrieve pre-calculated hash is a fatal error). In non-FIPS mode the checks
|
|
||||||
# still must be performed, unless the hashes are not installed. Thus if the hash
|
|
||||||
# file is not found (or the hash matches), proceed in non-FIPS mode and abort
|
|
||||||
# otherwise.
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/fips-check.c b/openssh-6.6p1/fips-check.c
|
|
||||||
new file mode 100644
|
|
||||||
--- /dev/null
|
|
||||||
+++ b/openssh-6.6p1/fips-check.c
|
|
||||||
@@ -0,0 +1,37 @@
|
|
||||||
+#include "includes.h"
|
|
||||||
+#include <fcntl.h>
|
|
||||||
+#include <limits.h>
|
|
||||||
+#include <stdio.h>
|
|
||||||
+#include <stdlib.h>
|
|
||||||
+#include <string.h>
|
|
||||||
+#include <sys/stat.h>
|
|
||||||
+#include <sys/types.h>
|
|
||||||
+#include <unistd.h>
|
|
||||||
+
|
|
||||||
+#include "digest.h"
|
|
||||||
+#include "fips.h"
|
|
||||||
+
|
|
||||||
+#include <openssl/err.h>
|
|
||||||
+
|
|
||||||
+#define PROC_NAME_LEN 64
|
|
||||||
+
|
|
||||||
+static const char *argv0;
|
|
||||||
+
|
|
||||||
+void
|
|
||||||
+print_help_exit(int ev)
|
|
||||||
+{
|
|
||||||
+ fprintf(stderr, "%s <-c|-w> <file> <checksum_file>\n", argv0);
|
|
||||||
+ fprintf(stderr, " -c verify hash of 'file' against hash in 'checksum_file'\n");
|
|
||||||
+ fprintf(stderr, " -w write hash of 'file' into 'checksum_file'\n");
|
|
||||||
+ exit(ev);
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+int
|
|
||||||
+main(int argc, char **argv)
|
|
||||||
+{
|
|
||||||
+
|
|
||||||
+ fips_ssh_init();
|
|
||||||
+// printf("SSL Error: %lx: %s", ERR_get_error(), ERR_get_string(ERR_get_error(), NULL));
|
|
||||||
+
|
|
||||||
+ return 0;
|
|
||||||
+}
|
|
||||||
diff --git a/openssh-6.6p1/fips.c b/openssh-6.6p1/fips.c
|
|
||||||
--- a/openssh-6.6p1/fips.c
|
|
||||||
+++ b/openssh-6.6p1/fips.c
|
|
||||||
@@ -24,21 +24,342 @@
|
|
||||||
|
|
||||||
#include "includes.h"
|
|
||||||
|
|
||||||
#include "fips.h"
|
|
||||||
|
|
||||||
#include "digest.h"
|
|
||||||
#include "key.h"
|
|
||||||
#include "log.h"
|
|
||||||
+#include "xmalloc.h"
|
|
||||||
+#include <openbsd-compat/openssl-compat.h>
|
|
||||||
+
|
|
||||||
+#include <errno.h>
|
|
||||||
+#include <fcntl.h>
|
|
||||||
+#include <string.h>
|
|
||||||
+#include <sys/mman.h>
|
|
||||||
+#include <sys/stat.h>
|
|
||||||
+#include <sys/types.h>
|
|
||||||
+#include <unistd.h>
|
|
||||||
|
|
||||||
#include <openssl/crypto.h>
|
|
||||||
+#include <openssl/err.h>
|
|
||||||
+
|
|
||||||
+enum fips_checksum_status {
|
|
||||||
+ CHECK_OK = 0,
|
|
||||||
+ CHECK_FAIL,
|
|
||||||
+ CHECK_MISSING
|
|
||||||
+};
|
|
||||||
|
|
||||||
static int fips_state = -1;
|
|
||||||
|
|
||||||
+static char *
|
|
||||||
+hex_fingerprint(u_int raw_len, u_char *raw)
|
|
||||||
+{
|
|
||||||
+ char *retval;
|
|
||||||
+ u_int i;
|
|
||||||
+
|
|
||||||
+ /* reserve space for both the key hash and the string for the hash type */
|
|
||||||
+ retval = malloc(3 * raw_len);
|
|
||||||
+ for (i = 0; i < raw_len; i++) {
|
|
||||||
+ char hex[4];
|
|
||||||
+ snprintf(hex, sizeof(hex), "%02x:", raw[i]);
|
|
||||||
+ strlcat(retval, hex, raw_len * 3);
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ return retval;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+/* calculates hash of contents of file given by filename using algorithm alg
|
|
||||||
+ * and placing the resukt into newly allacated memory - remember to free it
|
|
||||||
+ * when not needed anymore */
|
|
||||||
+static int
|
|
||||||
+hash_file(const char *filename, int alg, u_char **hash_out)
|
|
||||||
+{
|
|
||||||
+ int check = -1;
|
|
||||||
+ int hash_len;
|
|
||||||
+ int fd;
|
|
||||||
+ struct stat fs;
|
|
||||||
+ void *hmap;
|
|
||||||
+ char *hash;
|
|
||||||
+
|
|
||||||
+ hash_len = ssh_digest_bytes(alg);
|
|
||||||
+ hash = xmalloc(hash_len);
|
|
||||||
+
|
|
||||||
+ fd = open(filename, O_RDONLY);
|
|
||||||
+ if (-1 == fd)
|
|
||||||
+ goto bail_out;
|
|
||||||
+
|
|
||||||
+ if (-1 == fstat(fd, &fs))
|
|
||||||
+ goto bail_out;
|
|
||||||
+
|
|
||||||
+ hmap = mmap(NULL, fs.st_size, PROT_READ, MAP_SHARED, fd, 0);
|
|
||||||
+
|
|
||||||
+ if ((void *)(-1) != hmap) {
|
|
||||||
+ check = ssh_digest_memory(alg, hmap, fs.st_size, hash, hash_len);
|
|
||||||
+ munmap(hmap, fs.st_size);
|
|
||||||
+ }
|
|
||||||
+ close(fd);
|
|
||||||
+
|
|
||||||
+bail_out:
|
|
||||||
+ if (0 == check) {
|
|
||||||
+ check = CHECK_OK;
|
|
||||||
+ *hash_out = hash;
|
|
||||||
+ } else {
|
|
||||||
+ check = CHECK_FAIL;
|
|
||||||
+ *hash_out = NULL;
|
|
||||||
+ free(hash);
|
|
||||||
+ }
|
|
||||||
+ return check;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+/* find pathname of binary of process with PID pid. exe is buffer expected to
|
|
||||||
+ * be capable of holding at least max_pathlen characters
|
|
||||||
+ */
|
|
||||||
+static int
|
|
||||||
+get_executable_path(pid_t pid, char *exe, int max_pathlen)
|
|
||||||
+{
|
|
||||||
+ char exe_sl[PROC_EXE_PATH_LEN];
|
|
||||||
+ int n;
|
|
||||||
+
|
|
||||||
+ n = snprintf(exe_sl, sizeof(exe_sl), "/proc/%u/exe", pid);
|
|
||||||
+ if ((n <= 10) || (n >= max_pathlen)) {
|
|
||||||
+ fatal("error compiling filename of link to executable");
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ n = readlink(exe_sl, exe, max_pathlen);
|
|
||||||
+ if (n < max_pathlen) {
|
|
||||||
+ exe[n] = 0;
|
|
||||||
+ } else {
|
|
||||||
+ fatal("error getting executable pathname");
|
|
||||||
+ }
|
|
||||||
+ return 0;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+/* Read checksum file chk, storing the algorithm used for generating it into
|
|
||||||
+ * *alg; allocate enough memory to hold the hash and return it in *hash.
|
|
||||||
+ * Remember to free() it when not needed anymore.
|
|
||||||
+ */
|
|
||||||
+static int
|
|
||||||
+read_hash(const char *chk, int *alg, u_char **hash)
|
|
||||||
+{
|
|
||||||
+ int check = -1;
|
|
||||||
+ int hash_len;
|
|
||||||
+ int fdh, n;
|
|
||||||
+ char alg_c;
|
|
||||||
+ char *hash_in;
|
|
||||||
+
|
|
||||||
+ *hash = NULL;
|
|
||||||
+
|
|
||||||
+ fdh = open(chk, O_RDONLY);
|
|
||||||
+ if (-1 == fdh) {
|
|
||||||
+ switch (errno) {
|
|
||||||
+ case ENOENT:
|
|
||||||
+ check = CHECK_MISSING;
|
|
||||||
+ debug("fips: checksum file %s is missing\n", chk);
|
|
||||||
+ break;
|
|
||||||
+ default:
|
|
||||||
+ check = CHECK_FAIL;
|
|
||||||
+ debug("fips: ckecksum file %s not accessible\n", chk);
|
|
||||||
+ break;
|
|
||||||
+
|
|
||||||
+ }
|
|
||||||
+ goto bail_out;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ n = read(fdh, &alg_c, 1);
|
|
||||||
+ if (1 != n) {
|
|
||||||
+ check = CHECK_FAIL;
|
|
||||||
+ goto bail_out;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ *alg = (int)alg_c;
|
|
||||||
+ hash_len = ssh_digest_bytes(*alg);
|
|
||||||
+ hash_in = xmalloc(hash_len);
|
|
||||||
+
|
|
||||||
+ n = read(fdh, (void *)hash_in, hash_len);
|
|
||||||
+ if (hash_len != n) {
|
|
||||||
+ debug("fips: unable to read whole checksum from checksum file\n");
|
|
||||||
+ free (hash_in);
|
|
||||||
+ check = CHECK_FAIL;
|
|
||||||
+ } else {
|
|
||||||
+ check = CHECK_OK;
|
|
||||||
+ *hash = hash_in;
|
|
||||||
+ }
|
|
||||||
+bail_out:
|
|
||||||
+ return check;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+static int
|
|
||||||
+fips_hash_self(void)
|
|
||||||
+{
|
|
||||||
+ int check = -1;
|
|
||||||
+ int alg;
|
|
||||||
+ u_char *hash, *hash_chk;
|
|
||||||
+ char *exe, *chk;
|
|
||||||
+
|
|
||||||
+ exe = xmalloc(PATH_MAX);
|
|
||||||
+ chk = xmalloc(PATH_MAX);
|
|
||||||
+
|
|
||||||
+ /* we will need to add the ".chk" suffix and the null terminator */
|
|
||||||
+ check = get_executable_path(getpid(), exe
|
|
||||||
+ , PATH_MAX - strlen(CHECKSUM_SUFFIX) - 1);
|
|
||||||
+
|
|
||||||
+ strncpy(chk, exe, PATH_MAX);
|
|
||||||
+ strlcat(chk, CHECKSUM_SUFFIX, PATH_MAX);
|
|
||||||
+
|
|
||||||
+ check = read_hash(chk, &alg, &hash_chk);
|
|
||||||
+ if (CHECK_OK != check)
|
|
||||||
+ goto cleanup_chk;
|
|
||||||
+
|
|
||||||
+ check = hash_file(exe, alg, &hash);
|
|
||||||
+ if (CHECK_OK != check)
|
|
||||||
+ goto cleanup;
|
|
||||||
+
|
|
||||||
+ check = memcmp(hash, hash_chk, ssh_digest_bytes(alg));
|
|
||||||
+ if (0 == check) {
|
|
||||||
+ check = CHECK_OK;
|
|
||||||
+ debug("fips: checksum matches\n");
|
|
||||||
+ } else {
|
|
||||||
+ check = CHECK_FAIL;
|
|
||||||
+ debug("fips: checksum mismatch!\n");
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+cleanup:
|
|
||||||
+ free(hash);
|
|
||||||
+cleanup_chk:
|
|
||||||
+ free(hash_chk);
|
|
||||||
+ free(chk);
|
|
||||||
+ free(exe);
|
|
||||||
+
|
|
||||||
+ return check;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+static int
|
|
||||||
+fips_check_required_proc(void)
|
|
||||||
+{
|
|
||||||
+ int fips_required = 0;
|
|
||||||
+ int fips_fd;
|
|
||||||
+ char fips_sys = 0;
|
|
||||||
+
|
|
||||||
+ struct stat dummy;
|
|
||||||
+ if (-1 == stat(FIPS_PROC_PATH, &dummy)) {
|
|
||||||
+ switch (errno) {
|
|
||||||
+ case ENOENT:
|
|
||||||
+ case ENOTDIR:
|
|
||||||
+ break;
|
|
||||||
+ default:
|
|
||||||
+ fatal("Check for system-wide FIPS mode is required and %s cannot"
|
|
||||||
+ " be accessed for reason other than non-existence - aborting"
|
|
||||||
+ , FIPS_PROC_PATH);
|
|
||||||
+ break;
|
|
||||||
+ }
|
|
||||||
+ } else {
|
|
||||||
+ if (-1 == (fips_fd = open(FIPS_PROC_PATH, O_RDONLY)))
|
|
||||||
+ fatal("Check for system-wide FIPS mode is required and %s cannot"
|
|
||||||
+ " be opened for reading - aborting"
|
|
||||||
+ , FIPS_PROC_PATH);
|
|
||||||
+ if (1 > read(fips_fd, &fips_sys, 1))
|
|
||||||
+ fatal("Check for system-wide FIPS mode is required and %s doesn't"
|
|
||||||
+ " return at least one character - aborting"
|
|
||||||
+ , FIPS_PROC_PATH);
|
|
||||||
+ close(fips_sys);
|
|
||||||
+ switch (fips_sys) {
|
|
||||||
+ case '0':
|
|
||||||
+ case '1':
|
|
||||||
+ fips_required = fips_sys - '0';
|
|
||||||
+ break;
|
|
||||||
+ default:
|
|
||||||
+ fatal("Bogus character %c found in %s - aborting"
|
|
||||||
+ , fips_sys, FIPS_PROC_PATH);
|
|
||||||
+ }
|
|
||||||
+ }
|
|
||||||
+ return fips_required;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+static int
|
|
||||||
+fips_check_required_env(void)
|
|
||||||
+{
|
|
||||||
+ int fips_required = 0;
|
|
||||||
+ char *env = getenv(SSH_FORCE_FIPS_ENV);
|
|
||||||
+
|
|
||||||
+ if (env) {
|
|
||||||
+ errno = 0;
|
|
||||||
+ fips_required = strtol(env, NULL, 10);
|
|
||||||
+ if (errno) {
|
|
||||||
+ debug("bogus value in the %s environment variable, ignoring\n"
|
|
||||||
+ , SSH_FORCE_FIPS_ENV);
|
|
||||||
+ fips_required = 0;
|
|
||||||
+ } else
|
|
||||||
+ fips_required = 1;
|
|
||||||
+ }
|
|
||||||
+ return fips_required;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+static int
|
|
||||||
+fips_required(void)
|
|
||||||
+{
|
|
||||||
+ int fips_requests = 0;
|
|
||||||
+ fips_requests += fips_check_required_proc();
|
|
||||||
+ fips_requests += fips_check_required_env();
|
|
||||||
+ return fips_requests;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+/* check whether FIPS mode is required and perform selfchecksum/selftest */
|
|
||||||
+void
|
|
||||||
+fips_ssh_init(void)
|
|
||||||
+{
|
|
||||||
+ int checksum;
|
|
||||||
+
|
|
||||||
+ checksum = fips_hash_self();
|
|
||||||
+
|
|
||||||
+ if (fips_required()) {
|
|
||||||
+ switch (checksum) {
|
|
||||||
+ case CHECK_OK:
|
|
||||||
+ debug("fips: mandatory checksum ok");
|
|
||||||
+ break;
|
|
||||||
+ case CHECK_FAIL:
|
|
||||||
+ fatal("fips: mandatory checksum failed - aborting");
|
|
||||||
+ break;
|
|
||||||
+ case CHECK_MISSING:
|
|
||||||
+ fatal("fips: mandatory checksum data missing - aborting");
|
|
||||||
+ break;
|
|
||||||
+ default:
|
|
||||||
+ fatal("Fatal error: internal error at %s:%u"
|
|
||||||
+ , __FILE__, __LINE__);
|
|
||||||
+ break;
|
|
||||||
+ }
|
|
||||||
+ fips_state = FIPS_mode_set(1);
|
|
||||||
+ if (1 != fips_state) {
|
|
||||||
+ ERR_load_crypto_strings();
|
|
||||||
+ u_long err = ERR_get_error();
|
|
||||||
+ error("fips: OpenSSL error %lx: %s", err, ERR_error_string(err, NULL));
|
|
||||||
+ fatal("fips: unable to set OpenSSL into FIPS mode - aborting"
|
|
||||||
+ , fips_state);
|
|
||||||
+ }
|
|
||||||
+ } else {
|
|
||||||
+ switch (checksum) {
|
|
||||||
+ case CHECK_OK:
|
|
||||||
+ debug("fips: checksum ok");
|
|
||||||
+ break;
|
|
||||||
+ case CHECK_FAIL:
|
|
||||||
+ fatal("fips: checksum failed - aborting");
|
|
||||||
+ break;
|
|
||||||
+ case CHECK_MISSING:
|
|
||||||
+ debug("fips: mandatory checksum data missing, but not required - continuing non-FIPS");
|
|
||||||
+ break;
|
|
||||||
+ default:
|
|
||||||
+ fatal("Fatal error: internal error at %s:%u",
|
|
||||||
+ __FILE__, __LINE__);
|
|
||||||
+ break;
|
|
||||||
+ }
|
|
||||||
+ }
|
|
||||||
+ return;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
int
|
|
||||||
fips_mode()
|
|
||||||
{
|
|
||||||
if (-1 == fips_state) {
|
|
||||||
fips_state = FIPS_mode();
|
|
||||||
if (fips_state)
|
|
||||||
debug("FIPS mode initialized");
|
|
||||||
}
|
|
||||||
diff --git a/openssh-6.6p1/fips.h b/openssh-6.6p1/fips.h
|
|
||||||
--- a/openssh-6.6p1/fips.h
|
|
||||||
+++ b/openssh-6.6p1/fips.h
|
|
||||||
@@ -1,10 +1,10 @@
|
|
||||||
/*
|
|
||||||
- * Copyright (c) 2012 Petr Cerny. All rights reserved.
|
|
||||||
+ * Copyright (c) 2012-2014 Petr Cerny. All rights reserved.
|
|
||||||
*
|
|
||||||
* Redistribution and use in source and binary forms, with or without
|
|
||||||
* modification, are permitted provided that the following conditions
|
|
||||||
* are met:
|
|
||||||
* 1. Redistributions of source code must retain the above copyright
|
|
||||||
* notice, this list of conditions and the following disclaimer.
|
|
||||||
* 2. Redistributions in binary form must reproduce the above copyright
|
|
||||||
* notice, this list of conditions and the following disclaimer in the
|
|
||||||
@@ -19,15 +19,22 @@
|
|
||||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
||||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
|
||||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
|
||||||
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
||||||
*/
|
|
||||||
#ifndef FIPS_H
|
|
||||||
#define FIPS_H
|
|
||||||
|
|
||||||
+#define SSH_FORCE_FIPS_ENV "SSH_FORCE_FIPS"
|
|
||||||
+#define FIPS_PROC_PATH "/proc/sys/crypto/fips_enabled"
|
|
||||||
+
|
|
||||||
+#define PROC_EXE_PATH_LEN 64
|
|
||||||
+#define CHECKSUM_SUFFIX ".chk"
|
|
||||||
+
|
|
||||||
+void fips_ssh_init(void);
|
|
||||||
int fips_mode(void);
|
|
||||||
int fips_correct_dgst(int);
|
|
||||||
int fips_dgst_min(void);
|
|
||||||
enum fp_type fips_correct_fp_type(enum fp_type);
|
|
||||||
|
|
||||||
#endif
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/sftp-server.c b/openssh-6.6p1/sftp-server.c
|
|
||||||
--- a/openssh-6.6p1/sftp-server.c
|
|
||||||
+++ b/openssh-6.6p1/sftp-server.c
|
|
||||||
@@ -47,16 +47,18 @@
|
|
||||||
#include "log.h"
|
|
||||||
#include "misc.h"
|
|
||||||
#include "match.h"
|
|
||||||
#include "uidswap.h"
|
|
||||||
|
|
||||||
#include "sftp.h"
|
|
||||||
#include "sftp-common.h"
|
|
||||||
|
|
||||||
+#include "fips.h"
|
|
||||||
+
|
|
||||||
/* helper */
|
|
||||||
#define get_int64() buffer_get_int64(&iqueue);
|
|
||||||
#define get_int() buffer_get_int(&iqueue);
|
|
||||||
#define get_string(lenp) buffer_get_string(&iqueue, lenp);
|
|
||||||
|
|
||||||
/* Our verbosity */
|
|
||||||
static LogLevel log_level = SYSLOG_LEVEL_ERROR;
|
|
||||||
|
|
||||||
@@ -1453,16 +1455,19 @@ sftp_server_main(int argc, char **argv,
|
|
||||||
ssize_t len, olen, set_size;
|
|
||||||
SyslogFacility log_facility = SYSLOG_FACILITY_AUTH;
|
|
||||||
char *cp, *homedir = NULL, buf[4*4096];
|
|
||||||
long mask;
|
|
||||||
|
|
||||||
extern char *optarg;
|
|
||||||
extern char *__progname;
|
|
||||||
|
|
||||||
+ /* initialize fips */
|
|
||||||
+ fips_ssh_init();
|
|
||||||
+
|
|
||||||
__progname = ssh_get_progname(argv[0]);
|
|
||||||
log_init(__progname, log_level, log_facility, log_stderr);
|
|
||||||
|
|
||||||
pw = pwcopy(user_pw);
|
|
||||||
|
|
||||||
while (!skipargs && (ch = getopt(argc, argv,
|
|
||||||
"d:f:l:P:p:Q:u:m:cehR")) != -1) {
|
|
||||||
switch (ch) {
|
|
||||||
diff --git a/openssh-6.6p1/ssh.c b/openssh-6.6p1/ssh.c
|
|
||||||
--- a/openssh-6.6p1/ssh.c
|
|
||||||
+++ b/openssh-6.6p1/ssh.c
|
|
||||||
@@ -420,16 +420,19 @@ main(int ac, char **av)
|
|
||||||
struct stat st;
|
|
||||||
struct passwd *pw;
|
|
||||||
int timeout_ms;
|
|
||||||
extern int optind, optreset;
|
|
||||||
extern char *optarg;
|
|
||||||
Forward fwd;
|
|
||||||
struct addrinfo *addrs = NULL;
|
|
||||||
|
|
||||||
+ /* initialize fips */
|
|
||||||
+ fips_ssh_init();
|
|
||||||
+
|
|
||||||
/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
|
|
||||||
sanitise_stdfd();
|
|
||||||
|
|
||||||
__progname = ssh_get_progname(av[0]);
|
|
||||||
|
|
||||||
#ifndef HAVE_SETPROCTITLE
|
|
||||||
/* Prepare for later setproctitle emulation */
|
|
||||||
/* Save argv so it isn't clobbered by setproctitle() emulation */
|
|
||||||
diff --git a/openssh-6.6p1/sshd.c b/openssh-6.6p1/sshd.c
|
|
||||||
--- a/openssh-6.6p1/sshd.c
|
|
||||||
+++ b/openssh-6.6p1/sshd.c
|
|
||||||
@@ -1466,16 +1466,19 @@ main(int ac, char **av)
|
|
||||||
u_int64_t ibytes, obytes;
|
|
||||||
mode_t new_umask;
|
|
||||||
Key *key;
|
|
||||||
Key *pubkey;
|
|
||||||
int keytype;
|
|
||||||
Authctxt *authctxt;
|
|
||||||
struct connection_info *connection_info = get_connection_info(0, 0);
|
|
||||||
|
|
||||||
+ /* initialize fips */
|
|
||||||
+ fips_ssh_init();
|
|
||||||
+
|
|
||||||
#ifdef HAVE_SECUREWARE
|
|
||||||
(void)set_auth_parameters(ac, av);
|
|
||||||
#endif
|
|
||||||
__progname = ssh_get_progname(av[0]);
|
|
||||||
|
|
||||||
/* Save argv. Duplicate so setproctitle emulation doesn't clobber it */
|
|
||||||
saved_argc = ac;
|
|
||||||
rexec_argc = ac;
|
|
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@ -1,428 +0,0 @@
|
|||||||
# The patch below adds support for the deprecated 'gssapi' authentication
|
|
||||||
# mechanism to OpenSSH 3.8p1. The newer 'gssapi-with-mic' mechanism is included
|
|
||||||
# in this release. The use of 'gssapi' is deprecated due to the presence of
|
|
||||||
# potential man-in-the-middle attacks, which 'gssapi-with-mic' is not
|
|
||||||
# susceptible to.
|
|
||||||
#
|
|
||||||
# To use the patch apply it to a OpenSSH 3.8p1 source tree. After compiling,
|
|
||||||
# backwards compatibility may be obtained by supplying the
|
|
||||||
# 'GssapiEnableMitmAttack yes' option to either the client or server.
|
|
||||||
#
|
|
||||||
# It should be noted that this patch is being made available purely as a means
|
|
||||||
# of easing the process of moving to OpenSSH 3.8p1. Any new installations are
|
|
||||||
# recommended to use the 'gssapi-with-mic' mechanism. Existing installations
|
|
||||||
# are encouraged to upgrade as soon as possible.
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/auth2-gss.c b/openssh-6.6p1/auth2-gss.c
|
|
||||||
--- a/openssh-6.6p1/auth2-gss.c
|
|
||||||
+++ b/openssh-6.6p1/auth2-gss.c
|
|
||||||
@@ -168,16 +168,25 @@ input_gssapi_token(int type, u_int32_t p
|
|
||||||
dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
|
|
||||||
if (flags & GSS_C_INTEG_FLAG)
|
|
||||||
dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_MIC,
|
|
||||||
&input_gssapi_mic);
|
|
||||||
else
|
|
||||||
dispatch_set(
|
|
||||||
SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE,
|
|
||||||
&input_gssapi_exchange_complete);
|
|
||||||
+
|
|
||||||
+ /*
|
|
||||||
+ * Old style 'gssapi' didn't have the GSSAPI_MIC
|
|
||||||
+ * and went straight to sending exchange_complete
|
|
||||||
+ */
|
|
||||||
+ if (options.gss_enable_mitm)
|
|
||||||
+ dispatch_set(
|
|
||||||
+ SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE,
|
|
||||||
+ &input_gssapi_exchange_complete);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
gss_release_buffer(&min_status, &send_tok);
|
|
||||||
}
|
|
||||||
|
|
||||||
static void
|
|
||||||
input_gssapi_errtok(int type, u_int32_t plen, void *ctxt)
|
|
||||||
@@ -286,9 +295,15 @@ input_gssapi_mic(int type, u_int32_t ple
|
|
||||||
}
|
|
||||||
|
|
||||||
Authmethod method_gssapi = {
|
|
||||||
"gssapi-with-mic",
|
|
||||||
userauth_gssapi,
|
|
||||||
&options.gss_authentication
|
|
||||||
};
|
|
||||||
|
|
||||||
+Authmethod method_gssapi_old = {
|
|
||||||
+ "gssapi",
|
|
||||||
+ userauth_gssapi,
|
|
||||||
+ &options.gss_enable_mitm
|
|
||||||
+};
|
|
||||||
+
|
|
||||||
#endif /* GSSAPI */
|
|
||||||
diff --git a/openssh-6.6p1/auth2.c b/openssh-6.6p1/auth2.c
|
|
||||||
--- a/openssh-6.6p1/auth2.c
|
|
||||||
+++ b/openssh-6.6p1/auth2.c
|
|
||||||
@@ -65,23 +65,25 @@ extern Buffer loginmsg;
|
|
||||||
|
|
||||||
extern Authmethod method_none;
|
|
||||||
extern Authmethod method_pubkey;
|
|
||||||
extern Authmethod method_passwd;
|
|
||||||
extern Authmethod method_kbdint;
|
|
||||||
extern Authmethod method_hostbased;
|
|
||||||
#ifdef GSSAPI
|
|
||||||
extern Authmethod method_gssapi;
|
|
||||||
+extern Authmethod method_gssapi_old;
|
|
||||||
#endif
|
|
||||||
|
|
||||||
Authmethod *authmethods[] = {
|
|
||||||
&method_none,
|
|
||||||
&method_pubkey,
|
|
||||||
#ifdef GSSAPI
|
|
||||||
&method_gssapi,
|
|
||||||
+ &method_gssapi_old,
|
|
||||||
#endif
|
|
||||||
&method_passwd,
|
|
||||||
&method_kbdint,
|
|
||||||
&method_hostbased,
|
|
||||||
NULL
|
|
||||||
};
|
|
||||||
|
|
||||||
/* protocol */
|
|
||||||
diff --git a/openssh-6.6p1/readconf.c b/openssh-6.6p1/readconf.c
|
|
||||||
--- a/openssh-6.6p1/readconf.c
|
|
||||||
+++ b/openssh-6.6p1/readconf.c
|
|
||||||
@@ -135,17 +135,17 @@ typedef enum {
|
|
||||||
oCompressionLevel, oTCPKeepAlive, oNumberOfPasswordPrompts,
|
|
||||||
oUsePrivilegedPort, oLogLevel, oCiphers, oProtocol, oMacs,
|
|
||||||
oGlobalKnownHostsFile2, oUserKnownHostsFile2, oPubkeyAuthentication,
|
|
||||||
oKbdInteractiveAuthentication, oKbdInteractiveDevices, oHostKeyAlias,
|
|
||||||
oDynamicForward, oPreferredAuthentications, oHostbasedAuthentication,
|
|
||||||
oHostKeyAlgorithms, oBindAddress, oPKCS11Provider,
|
|
||||||
oClearAllForwardings, oNoHostAuthenticationForLocalhost,
|
|
||||||
oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
|
|
||||||
- oAddressFamily, oGssAuthentication, oGssDelegateCreds,
|
|
||||||
+ oAddressFamily, oGssAuthentication, oGssDelegateCreds, oGssEnableMITM,
|
|
||||||
oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
|
|
||||||
oSendEnv, oControlPath, oControlMaster, oControlPersist,
|
|
||||||
oHashKnownHosts,
|
|
||||||
oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand,
|
|
||||||
oVisualHostKey, oUseRoaming,
|
|
||||||
oKexAlgorithms, oIPQoS, oRequestTTY, oIgnoreUnknown, oProxyUseFdpass,
|
|
||||||
oCanonicalDomains, oCanonicalizeHostname, oCanonicalizeMaxDots,
|
|
||||||
oCanonicalizeFallbackLocal, oCanonicalizePermittedCNAMEs,
|
|
||||||
@@ -179,19 +179,21 @@ static struct {
|
|
||||||
{ "skeyauthentication", oChallengeResponseAuthentication }, /* alias */
|
|
||||||
{ "tisauthentication", oChallengeResponseAuthentication }, /* alias */
|
|
||||||
{ "kerberosauthentication", oUnsupported },
|
|
||||||
{ "kerberostgtpassing", oUnsupported },
|
|
||||||
{ "afstokenpassing", oUnsupported },
|
|
||||||
#if defined(GSSAPI)
|
|
||||||
{ "gssapiauthentication", oGssAuthentication },
|
|
||||||
{ "gssapidelegatecredentials", oGssDelegateCreds },
|
|
||||||
+ { "gssapienablemitmattack", oGssEnableMITM },
|
|
||||||
#else
|
|
||||||
{ "gssapiauthentication", oUnsupported },
|
|
||||||
{ "gssapidelegatecredentials", oUnsupported },
|
|
||||||
+ { "gssapienablemitmattack", oUnsupported },
|
|
||||||
#endif
|
|
||||||
{ "fallbacktorsh", oDeprecated },
|
|
||||||
{ "usersh", oDeprecated },
|
|
||||||
{ "identityfile", oIdentityFile },
|
|
||||||
{ "identityfile2", oIdentityFile }, /* obsolete */
|
|
||||||
{ "identitiesonly", oIdentitiesOnly },
|
|
||||||
{ "hostname", oHostName },
|
|
||||||
{ "hostkeyalias", oHostKeyAlias },
|
|
||||||
@@ -839,16 +841,20 @@ parse_time:
|
|
||||||
|
|
||||||
case oGssAuthentication:
|
|
||||||
intptr = &options->gss_authentication;
|
|
||||||
goto parse_flag;
|
|
||||||
|
|
||||||
case oGssDelegateCreds:
|
|
||||||
intptr = &options->gss_deleg_creds;
|
|
||||||
goto parse_flag;
|
|
||||||
+
|
|
||||||
+ case oGssEnableMITM:
|
|
||||||
+ intptr = &options->gss_enable_mitm;
|
|
||||||
+ goto parse_flag;
|
|
||||||
|
|
||||||
case oBatchMode:
|
|
||||||
intptr = &options->batch_mode;
|
|
||||||
goto parse_flag;
|
|
||||||
|
|
||||||
case oCheckHostIP:
|
|
||||||
intptr = &options->check_host_ip;
|
|
||||||
goto parse_flag;
|
|
||||||
@@ -1493,16 +1499,17 @@ initialize_options(Options * options)
|
|
||||||
options->xauth_location = NULL;
|
|
||||||
options->gateway_ports = -1;
|
|
||||||
options->use_privileged_port = -1;
|
|
||||||
options->rsa_authentication = -1;
|
|
||||||
options->pubkey_authentication = -1;
|
|
||||||
options->challenge_response_authentication = -1;
|
|
||||||
options->gss_authentication = -1;
|
|
||||||
options->gss_deleg_creds = -1;
|
|
||||||
+ options->gss_enable_mitm = -1;
|
|
||||||
options->password_authentication = -1;
|
|
||||||
options->kbd_interactive_authentication = -1;
|
|
||||||
options->kbd_interactive_devices = NULL;
|
|
||||||
options->rhosts_rsa_authentication = -1;
|
|
||||||
options->hostbased_authentication = -1;
|
|
||||||
options->batch_mode = -1;
|
|
||||||
options->check_host_ip = -1;
|
|
||||||
options->strict_host_key_checking = -1;
|
|
||||||
@@ -1613,16 +1620,18 @@ fill_default_options(Options * options)
|
|
||||||
if (options->pubkey_authentication == -1)
|
|
||||||
options->pubkey_authentication = 1;
|
|
||||||
if (options->challenge_response_authentication == -1)
|
|
||||||
options->challenge_response_authentication = 1;
|
|
||||||
if (options->gss_authentication == -1)
|
|
||||||
options->gss_authentication = 0;
|
|
||||||
if (options->gss_deleg_creds == -1)
|
|
||||||
options->gss_deleg_creds = 0;
|
|
||||||
+ if (options->gss_enable_mitm == -1)
|
|
||||||
+ options->gss_enable_mitm = 0;
|
|
||||||
if (options->password_authentication == -1)
|
|
||||||
options->password_authentication = 1;
|
|
||||||
if (options->kbd_interactive_authentication == -1)
|
|
||||||
options->kbd_interactive_authentication = 1;
|
|
||||||
if (options->rhosts_rsa_authentication == -1)
|
|
||||||
options->rhosts_rsa_authentication = 0;
|
|
||||||
if (options->hostbased_authentication == -1)
|
|
||||||
options->hostbased_authentication = 0;
|
|
||||||
diff --git a/openssh-6.6p1/readconf.h b/openssh-6.6p1/readconf.h
|
|
||||||
--- a/openssh-6.6p1/readconf.h
|
|
||||||
+++ b/openssh-6.6p1/readconf.h
|
|
||||||
@@ -50,16 +50,17 @@ typedef struct {
|
|
||||||
* authentication. */
|
|
||||||
int rsa_authentication; /* Try RSA authentication. */
|
|
||||||
int pubkey_authentication; /* Try ssh2 pubkey authentication. */
|
|
||||||
int hostbased_authentication; /* ssh2's rhosts_rsa */
|
|
||||||
int challenge_response_authentication;
|
|
||||||
/* Try S/Key or TIS, authentication. */
|
|
||||||
int gss_authentication; /* Try GSS authentication */
|
|
||||||
int gss_deleg_creds; /* Delegate GSS credentials */
|
|
||||||
+ int gss_enable_mitm; /* Enable old style gssapi auth */
|
|
||||||
int password_authentication; /* Try password
|
|
||||||
* authentication. */
|
|
||||||
int kbd_interactive_authentication; /* Try keyboard-interactive auth. */
|
|
||||||
char *kbd_interactive_devices; /* Keyboard-interactive auth devices. */
|
|
||||||
int batch_mode; /* Batch mode: do not ask for passwords. */
|
|
||||||
int check_host_ip; /* Also keep track of keys for IP address */
|
|
||||||
int strict_host_key_checking; /* Strict host key checking. */
|
|
||||||
int compression; /* Compress packets in both directions. */
|
|
||||||
diff --git a/openssh-6.6p1/servconf.c b/openssh-6.6p1/servconf.c
|
|
||||||
--- a/openssh-6.6p1/servconf.c
|
|
||||||
+++ b/openssh-6.6p1/servconf.c
|
|
||||||
@@ -104,16 +104,17 @@ initialize_server_options(ServerOptions
|
|
||||||
options->rsa_authentication = -1;
|
|
||||||
options->pubkey_authentication = -1;
|
|
||||||
options->kerberos_authentication = -1;
|
|
||||||
options->kerberos_or_local_passwd = -1;
|
|
||||||
options->kerberos_ticket_cleanup = -1;
|
|
||||||
options->kerberos_get_afs_token = -1;
|
|
||||||
options->gss_authentication=-1;
|
|
||||||
options->gss_cleanup_creds = -1;
|
|
||||||
+ options->gss_enable_mitm = -1;
|
|
||||||
options->password_authentication = -1;
|
|
||||||
options->kbd_interactive_authentication = -1;
|
|
||||||
options->challenge_response_authentication = -1;
|
|
||||||
options->permit_empty_passwd = -1;
|
|
||||||
options->permit_user_env = -1;
|
|
||||||
options->use_login = -1;
|
|
||||||
options->compression = -1;
|
|
||||||
options->rekey_limit = -1;
|
|
||||||
@@ -241,16 +242,18 @@ fill_default_server_options(ServerOption
|
|
||||||
if (options->kerberos_ticket_cleanup == -1)
|
|
||||||
options->kerberos_ticket_cleanup = 1;
|
|
||||||
if (options->kerberos_get_afs_token == -1)
|
|
||||||
options->kerberos_get_afs_token = 0;
|
|
||||||
if (options->gss_authentication == -1)
|
|
||||||
options->gss_authentication = 0;
|
|
||||||
if (options->gss_cleanup_creds == -1)
|
|
||||||
options->gss_cleanup_creds = 1;
|
|
||||||
+ if (options->gss_enable_mitm == -1)
|
|
||||||
+ options->gss_enable_mitm = 0;
|
|
||||||
if (options->password_authentication == -1)
|
|
||||||
options->password_authentication = 1;
|
|
||||||
if (options->kbd_interactive_authentication == -1)
|
|
||||||
options->kbd_interactive_authentication = 0;
|
|
||||||
if (options->challenge_response_authentication == -1)
|
|
||||||
options->challenge_response_authentication = 1;
|
|
||||||
if (options->permit_empty_passwd == -1)
|
|
||||||
options->permit_empty_passwd = 0;
|
|
||||||
@@ -335,17 +338,17 @@ typedef enum {
|
|
||||||
sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression,
|
|
||||||
sRekeyLimit, sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
|
|
||||||
sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
|
|
||||||
sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem,
|
|
||||||
sMaxStartups, sMaxAuthTries, sMaxSessions,
|
|
||||||
sBanner, sUseDNS, sHostbasedAuthentication,
|
|
||||||
sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
|
|
||||||
sClientAliveCountMax, sAuthorizedKeysFile,
|
|
||||||
- sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel,
|
|
||||||
+ sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel, sGssEnableMITM,
|
|
||||||
sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
|
|
||||||
sUsePrivilegeSeparation, sAllowAgentForwarding,
|
|
||||||
sHostCertificate,
|
|
||||||
sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile,
|
|
||||||
sKexAlgorithms, sIPQoS, sVersionAddendum,
|
|
||||||
sAuthorizedKeysCommand, sAuthorizedKeysCommandUser,
|
|
||||||
sAuthenticationMethods, sHostKeyAgent,
|
|
||||||
sDeprecated, sUnsupported
|
|
||||||
@@ -402,19 +405,21 @@ static struct {
|
|
||||||
{ "kerberosticketcleanup", sUnsupported, SSHCFG_GLOBAL },
|
|
||||||
{ "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
|
|
||||||
#endif
|
|
||||||
{ "kerberostgtpassing", sUnsupported, SSHCFG_GLOBAL },
|
|
||||||
{ "afstokenpassing", sUnsupported, SSHCFG_GLOBAL },
|
|
||||||
#ifdef GSSAPI
|
|
||||||
{ "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
|
|
||||||
{ "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL },
|
|
||||||
+ { "gssapienablemitmattack", sGssEnableMITM },
|
|
||||||
#else
|
|
||||||
{ "gssapiauthentication", sUnsupported, SSHCFG_ALL },
|
|
||||||
{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
|
|
||||||
+ { "gssapienablemitmattack", sUnsupported },
|
|
||||||
#endif
|
|
||||||
{ "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
|
|
||||||
{ "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
|
|
||||||
{ "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL },
|
|
||||||
{ "skeyauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL }, /* alias */
|
|
||||||
{ "checkmail", sDeprecated, SSHCFG_GLOBAL },
|
|
||||||
{ "listenaddress", sListenAddress, SSHCFG_GLOBAL },
|
|
||||||
{ "addressfamily", sAddressFamily, SSHCFG_GLOBAL },
|
|
||||||
@@ -1085,16 +1090,20 @@ process_server_config_line(ServerOptions
|
|
||||||
case sGssAuthentication:
|
|
||||||
intptr = &options->gss_authentication;
|
|
||||||
goto parse_flag;
|
|
||||||
|
|
||||||
case sGssCleanupCreds:
|
|
||||||
intptr = &options->gss_cleanup_creds;
|
|
||||||
goto parse_flag;
|
|
||||||
|
|
||||||
+ case sGssEnableMITM:
|
|
||||||
+ intptr = &options->gss_enable_mitm;
|
|
||||||
+ goto parse_flag;
|
|
||||||
+
|
|
||||||
case sPasswordAuthentication:
|
|
||||||
intptr = &options->password_authentication;
|
|
||||||
goto parse_flag;
|
|
||||||
|
|
||||||
case sKbdInteractiveAuthentication:
|
|
||||||
intptr = &options->kbd_interactive_authentication;
|
|
||||||
goto parse_flag;
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/servconf.h b/openssh-6.6p1/servconf.h
|
|
||||||
--- a/openssh-6.6p1/servconf.h
|
|
||||||
+++ b/openssh-6.6p1/servconf.h
|
|
||||||
@@ -108,16 +108,17 @@ typedef struct {
|
|
||||||
* such as SecurID or
|
|
||||||
* /etc/passwd */
|
|
||||||
int kerberos_ticket_cleanup; /* If true, destroy ticket
|
|
||||||
* file on logout. */
|
|
||||||
int kerberos_get_afs_token; /* If true, try to get AFS token if
|
|
||||||
* authenticated with Kerberos. */
|
|
||||||
int gss_authentication; /* If true, permit GSSAPI authentication */
|
|
||||||
int gss_cleanup_creds; /* If true, destroy cred cache on logout */
|
|
||||||
+ int gss_enable_mitm; /* If true, enable old style GSSAPI */
|
|
||||||
int password_authentication; /* If true, permit password
|
|
||||||
* authentication. */
|
|
||||||
int kbd_interactive_authentication; /* If true, permit */
|
|
||||||
int challenge_response_authentication;
|
|
||||||
int permit_empty_passwd; /* If false, do not permit empty
|
|
||||||
* passwords. */
|
|
||||||
int permit_user_env; /* If true, read ~/.ssh/environment */
|
|
||||||
int use_login; /* If true, login(1) is used */
|
|
||||||
diff --git a/openssh-6.6p1/ssh_config b/openssh-6.6p1/ssh_config
|
|
||||||
--- a/openssh-6.6p1/ssh_config
|
|
||||||
+++ b/openssh-6.6p1/ssh_config
|
|
||||||
@@ -51,9 +51,16 @@ ForwardX11Trusted yes
|
|
||||||
# Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc
|
|
||||||
# MACs hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160
|
|
||||||
# EscapeChar ~
|
|
||||||
# Tunnel no
|
|
||||||
# TunnelDevice any:any
|
|
||||||
# PermitLocalCommand no
|
|
||||||
# VisualHostKey no
|
|
||||||
# ProxyCommand ssh -q -W %h:%p gateway.example.com
|
|
||||||
+
|
|
||||||
+# Set this to 'yes' to enable support for the deprecated 'gssapi' authentication
|
|
||||||
+# mechanism to OpenSSH 3.8p1. The newer 'gssapi-with-mic' mechanism is included
|
|
||||||
+# in this release. The use of 'gssapi' is deprecated due to the presence of
|
|
||||||
+# potential man-in-the-middle attacks, which 'gssapi-with-mic' is not susceptible to.
|
|
||||||
+# GSSAPIEnableMITMAttack no
|
|
||||||
+
|
|
||||||
# RekeyLimit 1G 1h
|
|
||||||
diff --git a/openssh-6.6p1/sshconnect2.c b/openssh-6.6p1/sshconnect2.c
|
|
||||||
--- a/openssh-6.6p1/sshconnect2.c
|
|
||||||
+++ b/openssh-6.6p1/sshconnect2.c
|
|
||||||
@@ -318,16 +318,21 @@ static char *authmethods_get(void);
|
|
||||||
|
|
||||||
Authmethod authmethods[] = {
|
|
||||||
#ifdef GSSAPI
|
|
||||||
{"gssapi-with-mic",
|
|
||||||
userauth_gssapi,
|
|
||||||
NULL,
|
|
||||||
&options.gss_authentication,
|
|
||||||
NULL},
|
|
||||||
+ {"gssapi",
|
|
||||||
+ userauth_gssapi,
|
|
||||||
+ NULL,
|
|
||||||
+ &options.gss_enable_mitm,
|
|
||||||
+ NULL},
|
|
||||||
#endif
|
|
||||||
{"hostbased",
|
|
||||||
userauth_hostbased,
|
|
||||||
NULL,
|
|
||||||
&options.hostbased_authentication,
|
|
||||||
NULL},
|
|
||||||
{"publickey",
|
|
||||||
userauth_pubkey,
|
|
||||||
@@ -685,17 +690,19 @@ process_gssapi_token(void *ctxt, gss_buf
|
|
||||||
|
|
||||||
packet_put_string(send_tok.value, send_tok.length);
|
|
||||||
packet_send();
|
|
||||||
gss_release_buffer(&ms, &send_tok);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (status == GSS_S_COMPLETE) {
|
|
||||||
/* send either complete or MIC, depending on mechanism */
|
|
||||||
- if (!(flags & GSS_C_INTEG_FLAG)) {
|
|
||||||
+
|
|
||||||
+ if (strcmp(authctxt->method->name,"gssapi") == 0 ||
|
|
||||||
+ (!(flags & GSS_C_INTEG_FLAG))) {
|
|
||||||
packet_start(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE);
|
|
||||||
packet_send();
|
|
||||||
} else {
|
|
||||||
ssh_gssapi_buildmic(&b, authctxt->server_user,
|
|
||||||
authctxt->service, "gssapi-with-mic");
|
|
||||||
|
|
||||||
gssbuf.value = buffer_ptr(&b);
|
|
||||||
gssbuf.length = buffer_len(&b);
|
|
||||||
diff --git a/openssh-6.6p1/sshd_config b/openssh-6.6p1/sshd_config
|
|
||||||
--- a/openssh-6.6p1/sshd_config
|
|
||||||
+++ b/openssh-6.6p1/sshd_config
|
|
||||||
@@ -80,16 +80,23 @@ PasswordAuthentication no
|
|
||||||
#KerberosOrLocalPasswd yes
|
|
||||||
#KerberosTicketCleanup yes
|
|
||||||
#KerberosGetAFSToken no
|
|
||||||
|
|
||||||
# GSSAPI options
|
|
||||||
#GSSAPIAuthentication no
|
|
||||||
#GSSAPICleanupCredentials yes
|
|
||||||
|
|
||||||
+# Set this to 'yes' to enable support for the deprecated 'gssapi' authentication
|
|
||||||
+# mechanism to OpenSSH 3.8p1. The newer 'gssapi-with-mic' mechanism is included
|
|
||||||
+# in this release. The use of 'gssapi' is deprecated due to the presence of
|
|
||||||
+# potential man-in-the-middle attacks, which 'gssapi-with-mic' is not susceptible to.
|
|
||||||
+#GSSAPIEnableMITMAttack no
|
|
||||||
+
|
|
||||||
+
|
|
||||||
# Set this to 'yes' to enable PAM authentication, account processing,
|
|
||||||
# and session processing. If this is enabled, PAM authentication will
|
|
||||||
# be allowed through the ChallengeResponseAuthentication and
|
|
||||||
# PasswordAuthentication. Depending on your PAM configuration,
|
|
||||||
# PAM authentication via ChallengeResponseAuthentication may bypass
|
|
||||||
# the setting of "PermitRootLogin without-password".
|
|
||||||
# If you just want the PAM account and session checks to run without
|
|
||||||
# PAM authentication, then enable this but set PasswordAuthentication
|
|
@ -1,28 +0,0 @@
|
|||||||
# identify hashed hosts in known_hosts and suggest command line for their
|
|
||||||
# removal
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/sshconnect.c b/openssh-6.6p1/sshconnect.c
|
|
||||||
--- a/openssh-6.6p1/sshconnect.c
|
|
||||||
+++ b/openssh-6.6p1/sshconnect.c
|
|
||||||
@@ -1070,16 +1070,21 @@ check_host_key(char *hostname, struct so
|
|
||||||
ip_found->file, ip_found->line);
|
|
||||||
}
|
|
||||||
/* The host key has changed. */
|
|
||||||
warn_changed_key(host_key);
|
|
||||||
error("Add correct host key in %.100s to get rid of this message.",
|
|
||||||
user_hostfiles[0]);
|
|
||||||
error("Offending %s key in %s:%lu", key_type(host_found->key),
|
|
||||||
host_found->file, host_found->line);
|
|
||||||
+ error("You can use following command to remove all keys for this IP:");
|
|
||||||
+ if (host_found->file)
|
|
||||||
+ error("ssh-keygen -R %s -f %s", hostname, host_found->file);
|
|
||||||
+ else
|
|
||||||
+ error("ssh-keygen -R %s", hostname);
|
|
||||||
|
|
||||||
/*
|
|
||||||
* If strict host key checking is in use, the user will have
|
|
||||||
* to edit the key manually and we can only abort.
|
|
||||||
*/
|
|
||||||
if (options.strict_host_key_checking) {
|
|
||||||
error("%s host key for %.200s has changed and you have "
|
|
||||||
"requested strict checking.", type, host);
|
|
@ -1,534 +0,0 @@
|
|||||||
# SSHv1 to SSHv2 RSA keys converter
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/converter/Makefile b/openssh-6.6p1/converter/Makefile
|
|
||||||
new file mode 100644
|
|
||||||
--- /dev/null
|
|
||||||
+++ b/openssh-6.6p1/converter/Makefile
|
|
||||||
@@ -0,0 +1,17 @@
|
|
||||||
+
|
|
||||||
+bindir=/usr/bin
|
|
||||||
+mandir=/usr/share/man
|
|
||||||
+
|
|
||||||
+all : ssh-keyconverter
|
|
||||||
+
|
|
||||||
+ssh-keyconverter.o: ssh-keyconverter.c ../key.h ../authfile.h ../misc.h ../xmalloc.h
|
|
||||||
+ gcc $(RPM_OPT_FLAGS) -c -I../ $< -o $@
|
|
||||||
+
|
|
||||||
+ssh-keyconverter: ssh-keyconverter.o ../libssh.a ../openbsd-compat/libopenbsd-compat.a
|
|
||||||
+ gcc $< -Wl,--no-as-needed $(RPM_OPT_FLAGS) -L../ -L../openbsd-compat/ -lcrypto -lssh -lopenbsd-compat -lssh -lopenbsd-compat -lpam -ldl -lwrap -lutil -lz -lnsl -lcrypt -lssl -o $@
|
|
||||||
+
|
|
||||||
+install: ssh-keyconverter ssh-keyconverter.1
|
|
||||||
+ if [ ! -d $(DESTDIR)$(bindir) ]; then install -d -m 755 $(DESTDIR)$(bindir); fi
|
|
||||||
+ install -m 755 ssh-keyconverter $(DESTDIR)$(bindir)
|
|
||||||
+ if [ ! -d $(DESTDIR)$(mandir)/man1 ]; then install -d -m 755 $(DESTDIR)$(mandir)/man1; fi
|
|
||||||
+ install -m 644 ssh-keyconverter.1 $(DESTDIR)$(mandir)/man1
|
|
||||||
diff --git a/openssh-6.6p1/converter/ssh-keyconverter.1 b/openssh-6.6p1/converter/ssh-keyconverter.1
|
|
||||||
new file mode 100644
|
|
||||||
--- /dev/null
|
|
||||||
+++ b/openssh-6.6p1/converter/ssh-keyconverter.1
|
|
||||||
@@ -0,0 +1,155 @@
|
|
||||||
+.\" Manpage for ssh-keyconverter
|
|
||||||
+.\"
|
|
||||||
+.Dd February 2, 2002
|
|
||||||
+.Dt SSH-KEYCONVER 1
|
|
||||||
+.Os
|
|
||||||
+.Sh NAME
|
|
||||||
+.Nm ssh-keyconvert
|
|
||||||
+.Nd convert ssh v1 keys and authorization files
|
|
||||||
+.Sh SYNOPSIS
|
|
||||||
+.Nm ssh-keyconvert
|
|
||||||
+.Op Fl k
|
|
||||||
+.Op Fl o Ar output_file
|
|
||||||
+.Ar identity_file ...
|
|
||||||
+.Nm ssh-keyconvert
|
|
||||||
+.Op Fl a
|
|
||||||
+.Op Fl o Ar output_file
|
|
||||||
+.Ar authorization_file ...
|
|
||||||
+.Sh DESCRIPTION
|
|
||||||
+.Nm
|
|
||||||
+converts RSA public and private keys used for public key based
|
|
||||||
+user authentication with protocol version 1 to the format
|
|
||||||
+used with protocol version 2.
|
|
||||||
+.Pp
|
|
||||||
+When using RSA user authentication with SSH protocol version 1,
|
|
||||||
+the client uses the private key from
|
|
||||||
+.Pa $HOME/.ssh/identity
|
|
||||||
+to provide its identity to the server. The server grants or denies
|
|
||||||
+access based on whether the public part of this key is listed in
|
|
||||||
+.Pa $HOME/.ssh/authorized_keys .
|
|
||||||
+.Pp
|
|
||||||
+SSH protocol version 2 supports both DSA and RSA keys, but the
|
|
||||||
+way RSA keys are stored are differently. On the client, the default
|
|
||||||
+file name is
|
|
||||||
+.Pa .ssh/id_rsa
|
|
||||||
+rather than
|
|
||||||
+.Pa .ssh/identity ,
|
|
||||||
+and the file's format is different as well. On the server, the
|
|
||||||
+public porting of the key can still be stored in
|
|
||||||
+.Pa .ssh/authorized_keys ,
|
|
||||||
+but the key notation has changed as well.
|
|
||||||
+Therefore, when switching from protocol version 1
|
|
||||||
+to version 2, you either have to create a new identity key using
|
|
||||||
+.Xr ssh-keygen 1
|
|
||||||
+and add that key to the server's
|
|
||||||
+.Pa authorized_keys
|
|
||||||
+file, or you need to convert your keys using
|
|
||||||
+.Nm ssh-keyconvert .
|
|
||||||
+.Pp
|
|
||||||
+By default,
|
|
||||||
+.Nm
|
|
||||||
+will try to guess the type of file that is to be converted.
|
|
||||||
+If it fails to guess correctly, you can tell if what type of
|
|
||||||
+conversion to perform by specifying the
|
|
||||||
+.Fl k
|
|
||||||
+option to convert the private key, or the
|
|
||||||
+.Fl a
|
|
||||||
+option to convert an authorisation file.
|
|
||||||
+.Pp
|
|
||||||
+When converting your private keys stored in
|
|
||||||
+.Pa .ssh/identity ,
|
|
||||||
+.Nm
|
|
||||||
+will read the private key, prompting you for the pass phrase
|
|
||||||
+if the key is protected by a pass phrase. If the
|
|
||||||
+.Fl o
|
|
||||||
+option is given, it will write the private key to the specified
|
|
||||||
+file, using version 2 syntax. If the key was protected by a
|
|
||||||
+pass phrase, it will use the same pass phrase to protect the new
|
|
||||||
+file.
|
|
||||||
+It will also write the public portion of the key to a second file,
|
|
||||||
+using the specified file name with
|
|
||||||
+.Dq .pub
|
|
||||||
+appended.
|
|
||||||
+If the
|
|
||||||
+.Fl o
|
|
||||||
+option was not given, private and public key will be written to
|
|
||||||
+.Pa id_rsa
|
|
||||||
+and
|
|
||||||
+.Pa id_rsa.pub ,
|
|
||||||
+respectively, relative to the directory of the input key file.
|
|
||||||
+.Pp
|
|
||||||
+If the destination file already exists,
|
|
||||||
+.Nm
|
|
||||||
+will prompt the user for confirmation before overwriting the
|
|
||||||
+file, unless the
|
|
||||||
+.Fl f
|
|
||||||
+option is given.
|
|
||||||
+.Pp
|
|
||||||
+When converting your
|
|
||||||
+.Pa authorized_keys
|
|
||||||
+file,
|
|
||||||
+.Nm
|
|
||||||
+will ignore any keys in SSH version 2 format. Any public keys
|
|
||||||
+in version 1 format will be converted and appended to the output file
|
|
||||||
+using the new syntax. If the
|
|
||||||
+.Fl o
|
|
||||||
+option is given, keys are appended to the specified file. If it
|
|
||||||
+is not given,
|
|
||||||
+.Nm
|
|
||||||
+will append all keys to the input file.
|
|
||||||
+.Pp
|
|
||||||
+Note that
|
|
||||||
+.Nm
|
|
||||||
+does not check for duplicate keys, so if you run it on
|
|
||||||
+.Pa .ssh/authorized_keys
|
|
||||||
+more several times, the converted keys will show up several times.
|
|
||||||
+.Sh OPTIONS
|
|
||||||
+.Bl -tag -width Ds
|
|
||||||
+.It Fl k
|
|
||||||
+Convert private key file(s). The default is to guess the
|
|
||||||
+type of file that should be converted.
|
|
||||||
+.It Fl a
|
|
||||||
+Convert
|
|
||||||
+.Pa authorized_keys
|
|
||||||
+file(s). The default is to guess the
|
|
||||||
+type of file that should be converted.
|
|
||||||
+.It Fl o Ar outfile
|
|
||||||
+Specify the name of the output file.
|
|
||||||
+When converting an authorization file, all public keys will
|
|
||||||
+be appended to this file.
|
|
||||||
+For private key conversion, the private and public components of
|
|
||||||
+the key will be stored in
|
|
||||||
+.Pa outfile
|
|
||||||
+and
|
|
||||||
+.Pa outfile.pub ,
|
|
||||||
+respectively.
|
|
||||||
+Note that since every key must be stored in a separate file, you
|
|
||||||
+cannot use this option when you specify several input files.
|
|
||||||
+.It Fl f
|
|
||||||
+When converting a key file, and the output file already exists,
|
|
||||||
+.Nm
|
|
||||||
+will ask the user whether to overwrite the file. Using this option
|
|
||||||
+forces overwriting.
|
|
||||||
+.El
|
|
||||||
+.Sh AUTHORS
|
|
||||||
+OpenSSH is a derivative of the original and free
|
|
||||||
+ssh 1.2.12 release by Tatu Ylonen.
|
|
||||||
+Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos,
|
|
||||||
+Theo de Raadt and Dug Song
|
|
||||||
+removed many bugs, re-added newer features and
|
|
||||||
+created OpenSSH.
|
|
||||||
+.Nm
|
|
||||||
+was contributed by Olaf Kirch.
|
|
||||||
+.Sh SEE ALSO
|
|
||||||
+.Xr ssh 1 ,
|
|
||||||
+.Xr ssh-add 1 ,
|
|
||||||
+.Xr ssh-agent 1 ,
|
|
||||||
+.Xr sshd 8
|
|
||||||
+.Rs
|
|
||||||
+.%A J. Galbraith
|
|
||||||
+.%A R. Thayer
|
|
||||||
+.%T "SECSH Public Key File Format"
|
|
||||||
+.%N draft-ietf-secsh-publickeyfile-01.txt
|
|
||||||
+.%D March 2001
|
|
||||||
+.%O work in progress material
|
|
||||||
+.Re
|
|
||||||
diff --git a/openssh-6.6p1/converter/ssh-keyconverter.c b/openssh-6.6p1/converter/ssh-keyconverter.c
|
|
||||||
new file mode 100644
|
|
||||||
--- /dev/null
|
|
||||||
+++ b/openssh-6.6p1/converter/ssh-keyconverter.c
|
|
||||||
@@ -0,0 +1,345 @@
|
|
||||||
+/*
|
|
||||||
+ * SSH v1 to v2 RSA key converter.
|
|
||||||
+ *
|
|
||||||
+ * Instead of a manpage:
|
|
||||||
+ *
|
|
||||||
+ * ssh-keyconverter ~/.ssh/identity
|
|
||||||
+ * will put the old RSA key in ~/.ssh/id_rsa and id_rsa.pub
|
|
||||||
+ * If a "-o foofah" is given, the keys will be written to
|
|
||||||
+ * foofah and foofah.pub, respectively.
|
|
||||||
+ *
|
|
||||||
+ * ssh-keyconverter ~/.ssh/authorized_keys
|
|
||||||
+ * will convert all old RSA keys and add them to the
|
|
||||||
+ * input file. The -o foofah option will direct
|
|
||||||
+ * output to a different file.
|
|
||||||
+ * (Note that it's harmless to specify the same file
|
|
||||||
+ * as input and output, as ssh-keyconverter will ignore
|
|
||||||
+ * any v2 keys, and output is always appended, never
|
|
||||||
+ * replacing the original file).
|
|
||||||
+ *
|
|
||||||
+ * To compile:
|
|
||||||
+ *
|
|
||||||
+ * gcc -g -Wall -o ssh-keyconverter converter.c \
|
|
||||||
+ * -L. -Lopenbsd-compat/ -lssh -lopenbsd-compat -lssh \
|
|
||||||
+ * -lpam -ldl -lwrap -lutil -lz -lnsl \
|
|
||||||
+ * -Wl,-Bstatic -lcrypto -Wl,-dy
|
|
||||||
+ *
|
|
||||||
+ * Enjoy. --okir
|
|
||||||
+ */
|
|
||||||
+
|
|
||||||
+#include <stdio.h>
|
|
||||||
+#include <getopt.h>
|
|
||||||
+#include <string.h>
|
|
||||||
+#include <sys/param.h>
|
|
||||||
+#include <unistd.h>
|
|
||||||
+#include "key.h"
|
|
||||||
+#include "authfile.h"
|
|
||||||
+#include "misc.h"
|
|
||||||
+#include "xmalloc.h"
|
|
||||||
+
|
|
||||||
+#define TYPE_KEY 0
|
|
||||||
+#define TYPE_AUTHKEYS 1
|
|
||||||
+
|
|
||||||
+#define PASSPHRASE_ATTEMPTS 3
|
|
||||||
+
|
|
||||||
+static int opt_verbose = 0;
|
|
||||||
+static int opt_force = 0;
|
|
||||||
+
|
|
||||||
+static void convert(int, const char *, const char *);
|
|
||||||
+static void convert_private_key(const char *, const char *);
|
|
||||||
+static void convert_authorized_keys(const char *, const char *);
|
|
||||||
+static int fileok(const char *, char *, size_t);
|
|
||||||
+static int guess_type(const char *);
|
|
||||||
+
|
|
||||||
+int
|
|
||||||
+main(int argc, char **argv)
|
|
||||||
+{
|
|
||||||
+ int opt_type = -1;
|
|
||||||
+ char *opt_outfile = NULL;
|
|
||||||
+ int c;
|
|
||||||
+
|
|
||||||
+ while ((c = getopt(argc, argv, "afko:")) != -1) {
|
|
||||||
+ switch (c) {
|
|
||||||
+ case 'a':
|
|
||||||
+ opt_type = TYPE_AUTHKEYS;
|
|
||||||
+ break;
|
|
||||||
+ case 'f':
|
|
||||||
+ opt_force = 1;
|
|
||||||
+ break;
|
|
||||||
+ case 'k':
|
|
||||||
+ opt_type = TYPE_KEY;
|
|
||||||
+ break;
|
|
||||||
+ case 'o':
|
|
||||||
+ opt_outfile = optarg;
|
|
||||||
+ break;
|
|
||||||
+ case 'v':
|
|
||||||
+ opt_verbose++;
|
|
||||||
+ break;
|
|
||||||
+ default:
|
|
||||||
+ fprintf(stderr,
|
|
||||||
+ "usage: ssh-keyconvert [-a | -k] "
|
|
||||||
+ "[-o filename] [-v] ...\n");
|
|
||||||
+ exit(1);
|
|
||||||
+ }
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ /* Warning, nanny code follows */
|
|
||||||
+#if 0
|
|
||||||
+ if (opt_outfile && (argc - optind) > 1 && opt_type != TYPE_AUTHKEY) {
|
|
||||||
+ fprintf(stderr,
|
|
||||||
+ "Output file ambiguous: more than two "
|
|
||||||
+ "input files given. Abort.\n");
|
|
||||||
+ exit(1);
|
|
||||||
+ }
|
|
||||||
+#endif
|
|
||||||
+
|
|
||||||
+ if (optind == argc) {
|
|
||||||
+ fprintf(stderr,
|
|
||||||
+ "Missing input file(s).\n");
|
|
||||||
+ exit(1);
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ for (; optind < argc; optind++) {
|
|
||||||
+ char *name = argv[optind];
|
|
||||||
+ int type;
|
|
||||||
+
|
|
||||||
+ if ((type = opt_type) < 0)
|
|
||||||
+ type = guess_type(name);
|
|
||||||
+ convert(type, name, opt_outfile);
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ return 0;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+static void
|
|
||||||
+convert(int type, const char *iname, const char *oname)
|
|
||||||
+{
|
|
||||||
+ if (type == TYPE_KEY) {
|
|
||||||
+ convert_private_key(iname, oname);
|
|
||||||
+ } else if (type == TYPE_AUTHKEYS) {
|
|
||||||
+ convert_authorized_keys(iname, oname);
|
|
||||||
+ } else {
|
|
||||||
+ fprintf(stderr,
|
|
||||||
+ "Conversion type not yet implemented.\n");
|
|
||||||
+ exit(1);
|
|
||||||
+ }
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+static void
|
|
||||||
+convert_private_key(const char *iname, const char *oname)
|
|
||||||
+{
|
|
||||||
+ char prompt[1024], privname[PATH_MAX], pubname[PATH_MAX];
|
|
||||||
+ char *comment = NULL, *passphrase;
|
|
||||||
+ Key *key = NULL, *pk = NULL;
|
|
||||||
+ int i;
|
|
||||||
+ FILE *pf = NULL;
|
|
||||||
+
|
|
||||||
+ passphrase = xstrdup("");
|
|
||||||
+ snprintf(prompt, sizeof(prompt),
|
|
||||||
+ "Enter passphrase for key '%.100s': ",iname);
|
|
||||||
+ for (i = 0; !key && i < PASSPHRASE_ATTEMPTS; i++) {
|
|
||||||
+ if (i) {
|
|
||||||
+ /* Zap old pass phrase */
|
|
||||||
+ memset(passphrase, 0, strlen(passphrase));
|
|
||||||
+ free(passphrase);
|
|
||||||
+
|
|
||||||
+ /* Get a pass phrase from the user */
|
|
||||||
+ passphrase = read_passphrase(prompt, 0);
|
|
||||||
+ }
|
|
||||||
+ key = key_load_private(iname, passphrase, &comment);
|
|
||||||
+ if (!key && i)
|
|
||||||
+ printf("Bad passphrase, please try again.\n");
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ if (oname != NULL) {
|
|
||||||
+ strcpy(privname, oname);
|
|
||||||
+ } else {
|
|
||||||
+ const char *s;
|
|
||||||
+
|
|
||||||
+ if ((s = strrchr(iname, '/')) != NULL) {
|
|
||||||
+ int n = s + 1 - iname;
|
|
||||||
+
|
|
||||||
+ strncpy(privname, iname, n);
|
|
||||||
+ privname[n++] = '\0';
|
|
||||||
+ }
|
|
||||||
+ strcat(privname, "id_rsa");
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ if (!fileok("private", privname, sizeof(privname)))
|
|
||||||
+ goto out;
|
|
||||||
+
|
|
||||||
+ sprintf(pubname, "%s.pub", privname);
|
|
||||||
+ if (!fileok("public", pubname, sizeof(pubname)))
|
|
||||||
+ goto out;
|
|
||||||
+
|
|
||||||
+ /* "convert" from RSA1 to RSA */
|
|
||||||
+ key->type = KEY_RSA;
|
|
||||||
+ pk = key_from_private(key);
|
|
||||||
+
|
|
||||||
+ /* Now write the key in earnest */
|
|
||||||
+ if (!key_save_private(key, privname, passphrase, comment)) {
|
|
||||||
+ fprintf(stderr,
|
|
||||||
+ "Failed to save private key to %s: %m.\n", privname);
|
|
||||||
+ goto out;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ if (!(pf = fopen(pubname, "w"))) {
|
|
||||||
+ fprintf(stderr,
|
|
||||||
+ "Failed to save public key to %s: %m.\n", pubname);
|
|
||||||
+ goto out;
|
|
||||||
+ }
|
|
||||||
+ if (!key_write(pk, pf)) {
|
|
||||||
+ fprintf(stderr,
|
|
||||||
+ "Failed to save public key to %s: %m.\n", pubname);
|
|
||||||
+ goto out;
|
|
||||||
+ }
|
|
||||||
+ if (comment)
|
|
||||||
+ fprintf(pf, " %s\n", comment);
|
|
||||||
+
|
|
||||||
+out:
|
|
||||||
+ memset(passphrase, 0, strlen(passphrase));
|
|
||||||
+ free(passphrase);
|
|
||||||
+ if (key)
|
|
||||||
+ key_free(key);
|
|
||||||
+ if (pk)
|
|
||||||
+ key_free(pk);
|
|
||||||
+ if (pf)
|
|
||||||
+ fclose(pf);
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+static void
|
|
||||||
+convert_authorized_keys(const char *iname, const char *oname)
|
|
||||||
+{
|
|
||||||
+ char line[1024];
|
|
||||||
+ FILE *ifp, *ofp;
|
|
||||||
+ Key *key;
|
|
||||||
+
|
|
||||||
+ if (!(ifp = fopen(iname, "r"))) {
|
|
||||||
+ perror(iname);
|
|
||||||
+ exit(1);
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ if (oname == NULL)
|
|
||||||
+ oname = iname;
|
|
||||||
+
|
|
||||||
+ if (!strcmp(oname, "-")) {
|
|
||||||
+ ofp = stdout;
|
|
||||||
+ } else {
|
|
||||||
+ if ((ofp = fopen(oname, "a")) == NULL) {
|
|
||||||
+ perror(oname);
|
|
||||||
+ exit(1);
|
|
||||||
+ }
|
|
||||||
+ }
|
|
||||||
+ setlinebuf(ofp);
|
|
||||||
+
|
|
||||||
+#define whitespace(c) ((c) == ' ' || (c) == '\t')
|
|
||||||
+ while (fgets(line, sizeof(line), ifp) != NULL) {
|
|
||||||
+ char *cp = line, *options = NULL;
|
|
||||||
+
|
|
||||||
+ while (whitespace(*cp))
|
|
||||||
+ cp++;
|
|
||||||
+ if (!*cp || *cp == '\n' || *cp == '#')
|
|
||||||
+ continue;
|
|
||||||
+
|
|
||||||
+ key = key_new(KEY_RSA1);
|
|
||||||
+ if (key_read(key, &cp) != 1) {
|
|
||||||
+ /* Skip options, if any */
|
|
||||||
+ int quoted = 0;
|
|
||||||
+
|
|
||||||
+ options = cp;
|
|
||||||
+ for (; *cp && (quoted || !whitespace(*cp)); cp++) {
|
|
||||||
+ if (cp[0] == '\\' && cp[1] == '"')
|
|
||||||
+ ++cp;
|
|
||||||
+ else if (*cp == '"')
|
|
||||||
+ quoted = !quoted;
|
|
||||||
+ }
|
|
||||||
+ if (quoted)
|
|
||||||
+ goto next;
|
|
||||||
+ *cp++ = '\0';
|
|
||||||
+ while (whitespace(*cp))
|
|
||||||
+ cp++;
|
|
||||||
+ if (key_read(key, &cp) != 1)
|
|
||||||
+ goto next;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ if (options)
|
|
||||||
+ fprintf(ofp, "%s ", options);
|
|
||||||
+ /* "convert" from RSA1 to RSA */
|
|
||||||
+ key->type = KEY_RSA;
|
|
||||||
+ key_write(key, ofp);
|
|
||||||
+ fputs(cp, ofp);
|
|
||||||
+ key_free(key);
|
|
||||||
+
|
|
||||||
+ next:
|
|
||||||
+ ;
|
|
||||||
+ }
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+/* if file exists, ask user whether to overwrite it */
|
|
||||||
+static int
|
|
||||||
+fileok(const char *what, char *filename, size_t size)
|
|
||||||
+{
|
|
||||||
+ char buffer[PATH_MAX];
|
|
||||||
+ int n;
|
|
||||||
+
|
|
||||||
+checkagain:
|
|
||||||
+ if (access(filename, F_OK) < 0)
|
|
||||||
+ return 1;
|
|
||||||
+ printf("%s key file %s already exists.\n", what, filename);
|
|
||||||
+ if (opt_force) {
|
|
||||||
+ printf("Overwriting because of -f option...\n");
|
|
||||||
+ return 1;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+tryagain:
|
|
||||||
+ printf("Please enter a different filename, "
|
|
||||||
+ "or return to overwrite: ");
|
|
||||||
+ fflush(stdout);
|
|
||||||
+
|
|
||||||
+ n = read(0, buffer, sizeof(buffer)-1);
|
|
||||||
+ if (n <= 0)
|
|
||||||
+ printf("\n");
|
|
||||||
+ if (n < 0) {
|
|
||||||
+ perror("read failed");
|
|
||||||
+ exit(1);
|
|
||||||
+ }
|
|
||||||
+ if (n == 0) {
|
|
||||||
+ fprintf(stderr, "EOF from standard input. Bye.\n");
|
|
||||||
+ exit(1);
|
|
||||||
+ }
|
|
||||||
+ buffer[n] = '\0';
|
|
||||||
+ while (n && buffer[n-1] == '\n')
|
|
||||||
+ buffer[--n] = '\0';
|
|
||||||
+ if (n == 0)
|
|
||||||
+ return 1;
|
|
||||||
+ if (n >= size) {
|
|
||||||
+ fprintf(stderr, "Filename too long.\n");
|
|
||||||
+ goto tryagain;
|
|
||||||
+ }
|
|
||||||
+ strcpy(filename, buffer);
|
|
||||||
+ goto checkagain;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+/*
|
|
||||||
+ * Guess the type of file to be converted.
|
|
||||||
+ * XXX: should look at the file; v1 key files
|
|
||||||
+ * start with "SSH PRIVATE KEY FILE"
|
|
||||||
+ */
|
|
||||||
+static int
|
|
||||||
+guess_type(const char *name)
|
|
||||||
+{
|
|
||||||
+ printf("%s... ", name);
|
|
||||||
+ if (strstr(name, "identity")) {
|
|
||||||
+ printf("looks like a key file\n");
|
|
||||||
+ return TYPE_KEY;
|
|
||||||
+ }
|
|
||||||
+ if (strstr(name, "authorized_keys")) {
|
|
||||||
+ printf("looks like an authorized_keys file\n");
|
|
||||||
+ return TYPE_AUTHKEYS;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ if (opt_verbose)
|
|
||||||
+ printf("unable to identify.");
|
|
||||||
+ fprintf(stderr, "Please specify the file type for %s. Abort.\n", name);
|
|
||||||
+ exit(1);
|
|
||||||
+}
|
|
File diff suppressed because it is too large
Load Diff
@ -1,28 +0,0 @@
|
|||||||
# login-pam cannot handle the option terminator "--" as login from util-linux
|
|
||||||
# (this is correct behaviour considering its man-page), hence use option which
|
|
||||||
# selects the compile-time branch in the code which doesn't use the terminator
|
|
||||||
#
|
|
||||||
# bnc#833605
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/configure.ac b/openssh-6.6p1/configure.ac
|
|
||||||
--- a/openssh-6.6p1/configure.ac
|
|
||||||
+++ b/openssh-6.6p1/configure.ac
|
|
||||||
@@ -719,16 +719,18 @@ main() { if (NSVersionOfRunTimeLibrary("
|
|
||||||
AC_DEFINE([_PATH_BTMP], ["/var/log/btmp"], [log for bad login attempts])
|
|
||||||
AC_DEFINE([USE_BTMP], [1], [Use btmp to log bad logins])
|
|
||||||
;;
|
|
||||||
*-*-linux*)
|
|
||||||
no_dev_ptmx=1
|
|
||||||
use_pie=auto
|
|
||||||
check_for_libcrypt_later=1
|
|
||||||
check_for_openpty_ctty_bug=1
|
|
||||||
+ AC_DEFINE([LOGIN_NO_ENDOPT], [1],
|
|
||||||
+ [Define if your login program cannot handle end of options ("--")])
|
|
||||||
AC_DEFINE([PAM_TTY_KLUDGE], [1],
|
|
||||||
[Work around problematic Linux PAM modules handling of PAM_TTY])
|
|
||||||
AC_DEFINE([LOCKED_PASSWD_PREFIX], ["!"],
|
|
||||||
[String used in /etc/passwd to denote locked account])
|
|
||||||
AC_DEFINE([SPT_TYPE], [SPT_REUSEARGV])
|
|
||||||
AC_DEFINE([LINK_OPNOTSUPP_ERRNO], [EPERM],
|
|
||||||
[Define to whatever link() returns for "not supported"
|
|
||||||
if it doesn't return EOPNOTSUPP.])
|
|
@ -1,24 +0,0 @@
|
|||||||
# Do not write a PID file when not daemonizing (e.g. when running from systemd)
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/sshd.c b/openssh-6.6p1/sshd.c
|
|
||||||
--- a/openssh-6.6p1/sshd.c
|
|
||||||
+++ b/openssh-6.6p1/sshd.c
|
|
||||||
@@ -1994,17 +1994,17 @@ main(int ac, char **av)
|
|
||||||
signal(SIGCHLD, main_sigchld_handler);
|
|
||||||
signal(SIGTERM, sigterm_handler);
|
|
||||||
signal(SIGQUIT, sigterm_handler);
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Write out the pid file after the sigterm handler
|
|
||||||
* is setup and the listen sockets are bound
|
|
||||||
*/
|
|
||||||
- if (!debug_flag) {
|
|
||||||
+ if (!(debug_flag || no_daemon_flag)) {
|
|
||||||
FILE *f = fopen(options.pid_file, "w");
|
|
||||||
|
|
||||||
if (f == NULL) {
|
|
||||||
error("Couldn't create pid file \"%s\": %s",
|
|
||||||
options.pid_file, strerror(errno));
|
|
||||||
} else {
|
|
||||||
fprintf(f, "%ld\n", (long) getpid());
|
|
||||||
fclose(f);
|
|
@ -1,28 +0,0 @@
|
|||||||
# related to bnc#49845, upstream bug #529
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/sshd.c b/openssh-6.6p1/sshd.c
|
|
||||||
--- a/openssh-6.6p1/sshd.c
|
|
||||||
+++ b/openssh-6.6p1/sshd.c
|
|
||||||
@@ -1405,17 +1405,21 @@ main(int ac, char **av)
|
|
||||||
saved_argv = xcalloc(ac + 1, sizeof(*saved_argv));
|
|
||||||
for (i = 0; i < ac; i++)
|
|
||||||
saved_argv[i] = xstrdup(av[i]);
|
|
||||||
saved_argv[i] = NULL;
|
|
||||||
|
|
||||||
#ifndef HAVE_SETPROCTITLE
|
|
||||||
/* Prepare for later setproctitle emulation */
|
|
||||||
compat_init_setproctitle(ac, av);
|
|
||||||
- av = saved_argv;
|
|
||||||
+
|
|
||||||
+ av = xmalloc(sizeof(*saved_argv) * (saved_argc + 1));
|
|
||||||
+ for (i = 0; i < saved_argc; i++)
|
|
||||||
+ av[i] = xstrdup(saved_argv[i]);
|
|
||||||
+ av[i] = NULL;
|
|
||||||
#endif
|
|
||||||
|
|
||||||
if (geteuid() == 0 && setgroups(0, NULL) == -1)
|
|
||||||
debug("setgroups(): %.200s", strerror(errno));
|
|
||||||
|
|
||||||
/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
|
|
||||||
sanitise_stdfd();
|
|
||||||
|
|
@ -1,29 +0,0 @@
|
|||||||
# HG changeset patch
|
|
||||||
# Parent bde6f1a808f345e141a976ebc3e37903c81a09cb
|
|
||||||
add 'getuid' syscall to list of allowed ones to prevent the sanboxed thread
|
|
||||||
from being killed by the seccomp filter
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/sandbox-seccomp-filter.c b/openssh-6.6p1/sandbox-seccomp-filter.c
|
|
||||||
--- a/openssh-6.6p1/sandbox-seccomp-filter.c
|
|
||||||
+++ b/openssh-6.6p1/sandbox-seccomp-filter.c
|
|
||||||
@@ -85,16 +85,20 @@ static const struct sock_filter preauth_
|
|
||||||
offsetof(struct seccomp_data, arch)),
|
|
||||||
BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SECCOMP_AUDIT_ARCH, 1, 0),
|
|
||||||
BPF_STMT(BPF_RET+BPF_K, SECCOMP_FILTER_FAIL),
|
|
||||||
/* Load the syscall number for checking. */
|
|
||||||
BPF_STMT(BPF_LD+BPF_W+BPF_ABS,
|
|
||||||
offsetof(struct seccomp_data, nr)),
|
|
||||||
SC_DENY(open, EACCES),
|
|
||||||
SC_ALLOW(getpid),
|
|
||||||
+ SC_ALLOW(getuid),
|
|
||||||
+#ifdef __NR_getuid32
|
|
||||||
+ SC_ALLOW(getuid32),
|
|
||||||
+#endif
|
|
||||||
SC_ALLOW(gettimeofday),
|
|
||||||
SC_ALLOW(clock_gettime),
|
|
||||||
#ifdef __NR_time /* not defined on EABI ARM */
|
|
||||||
SC_ALLOW(time),
|
|
||||||
#endif
|
|
||||||
SC_ALLOW(read),
|
|
||||||
SC_ALLOW(write),
|
|
||||||
SC_ALLOW(close),
|
|
@ -1,28 +0,0 @@
|
|||||||
# HG changeset patch
|
|
||||||
# Parent 8c8249d4e830ade9dfa1d2294c6218bbe439cb4a
|
|
||||||
Allow the stat() syscall for OpenSSL re-seed patch
|
|
||||||
(which causes OpenSSL use stat() on some file)
|
|
||||||
|
|
||||||
bnc#912436
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/sandbox-seccomp-filter.c b/openssh-6.6p1/sandbox-seccomp-filter.c
|
|
||||||
--- a/openssh-6.6p1/sandbox-seccomp-filter.c
|
|
||||||
+++ b/openssh-6.6p1/sandbox-seccomp-filter.c
|
|
||||||
@@ -97,16 +97,17 @@ static const struct sock_filter preauth_
|
|
||||||
SC_ALLOW(gettimeofday),
|
|
||||||
SC_ALLOW(clock_gettime),
|
|
||||||
#ifdef __NR_time /* not defined on EABI ARM */
|
|
||||||
SC_ALLOW(time),
|
|
||||||
#endif
|
|
||||||
SC_ALLOW(read),
|
|
||||||
SC_ALLOW(write),
|
|
||||||
SC_ALLOW(close),
|
|
||||||
+ SC_ALLOW(stat),
|
|
||||||
#ifdef __NR_shutdown /* not defined on archs that go via socketcall(2) */
|
|
||||||
SC_ALLOW(shutdown),
|
|
||||||
#endif
|
|
||||||
SC_ALLOW(brk),
|
|
||||||
SC_ALLOW(poll),
|
|
||||||
#ifdef __NR__newselect
|
|
||||||
SC_ALLOW(_newselect),
|
|
||||||
#else
|
|
@ -1,542 +0,0 @@
|
|||||||
# extended support for (re-)seeding the OpenSSL PRNG from /dev/random
|
|
||||||
# bnc#703221, FATE#312172
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/audit-bsm.c b/openssh-6.6p1/audit-bsm.c
|
|
||||||
--- a/openssh-6.6p1/audit-bsm.c
|
|
||||||
+++ b/openssh-6.6p1/audit-bsm.c
|
|
||||||
@@ -504,9 +504,15 @@ audit_destroy_sensitive_data(const char
|
|
||||||
/* not implemented */
|
|
||||||
}
|
|
||||||
|
|
||||||
void
|
|
||||||
audit_generate_ephemeral_server_key(const char *fp)
|
|
||||||
{
|
|
||||||
/* not implemented */
|
|
||||||
}
|
|
||||||
+
|
|
||||||
+void
|
|
||||||
+audit_linux_prng_seed(long bytes, const char *rf)
|
|
||||||
+{
|
|
||||||
+ /* not implemented */
|
|
||||||
+}
|
|
||||||
#endif /* BSM */
|
|
||||||
diff --git a/openssh-6.6p1/audit-linux.c b/openssh-6.6p1/audit-linux.c
|
|
||||||
--- a/openssh-6.6p1/audit-linux.c
|
|
||||||
+++ b/openssh-6.6p1/audit-linux.c
|
|
||||||
@@ -398,9 +398,31 @@ audit_generate_ephemeral_server_key(cons
|
|
||||||
}
|
|
||||||
audit_ok = audit_log_user_message(audit_fd, AUDIT_CRYPTO_KEY_USER,
|
|
||||||
buf, NULL, 0, NULL, 1);
|
|
||||||
audit_close(audit_fd);
|
|
||||||
/* do not abort if the error is EPERM and sshd is run as non root user */
|
|
||||||
if ((audit_ok < 0) && ((audit_ok != -1) || (getuid() == 0)))
|
|
||||||
error("cannot write into audit");
|
|
||||||
}
|
|
||||||
+
|
|
||||||
+void
|
|
||||||
+audit_linux_prng_seed(long bytes, const char *rf)
|
|
||||||
+{
|
|
||||||
+ char buf[AUDIT_LOG_SIZE];
|
|
||||||
+ int audit_fd, audit_ok;
|
|
||||||
+
|
|
||||||
+ snprintf(buf, sizeof(buf), "op=prng_seed kind=server bytes=%li source=%s ", bytes, rf);
|
|
||||||
+ audit_fd = audit_open();
|
|
||||||
+ if (audit_fd < 0) {
|
|
||||||
+ if (errno != EINVAL && errno != EPROTONOSUPPORT &&
|
|
||||||
+ errno != EAFNOSUPPORT)
|
|
||||||
+ error("cannot open audit");
|
|
||||||
+ return;
|
|
||||||
+ }
|
|
||||||
+ audit_ok = audit_log_user_message(audit_fd, AUDIT_CRYPTO_PARAM_CHANGE_USER,
|
|
||||||
+ buf, NULL, 0, NULL, 1);
|
|
||||||
+ audit_close(audit_fd);
|
|
||||||
+ /* do not abort if the error is EPERM and sshd is run as non root user */
|
|
||||||
+ if ((audit_ok < 0) && ((audit_ok != -1) || (getuid() == 0)))
|
|
||||||
+ error("cannot write into audit");
|
|
||||||
+}
|
|
||||||
#endif /* USE_LINUX_AUDIT */
|
|
||||||
diff --git a/openssh-6.6p1/audit.c b/openssh-6.6p1/audit.c
|
|
||||||
--- a/openssh-6.6p1/audit.c
|
|
||||||
+++ b/openssh-6.6p1/audit.c
|
|
||||||
@@ -304,10 +304,16 @@ audit_destroy_sensitive_data(const char
|
|
||||||
/*
|
|
||||||
* This will be called on generation of the ephemeral server key
|
|
||||||
*/
|
|
||||||
void
|
|
||||||
audit_generate_ephemeral_server_key(const char *)
|
|
||||||
{
|
|
||||||
debug("audit create ephemeral server key euid %d fingerprint %s", geteuid(), fp);
|
|
||||||
}
|
|
||||||
+
|
|
||||||
+void
|
|
||||||
+audit_linux_prng_seed(long bytes, const char *rf)
|
|
||||||
+{
|
|
||||||
+ debug("audit PRNG seed euid %d bytes %li source %s", geteuid(), bytes, rf);
|
|
||||||
+}
|
|
||||||
# endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */
|
|
||||||
#endif /* SSH_AUDIT_EVENTS */
|
|
||||||
diff --git a/openssh-6.6p1/audit.h b/openssh-6.6p1/audit.h
|
|
||||||
--- a/openssh-6.6p1/audit.h
|
|
||||||
+++ b/openssh-6.6p1/audit.h
|
|
||||||
@@ -63,10 +63,11 @@ void audit_key(int, int *, const Key *);
|
|
||||||
void audit_unsupported(int);
|
|
||||||
void audit_kex(int, char *, char *, char *);
|
|
||||||
void audit_unsupported_body(int);
|
|
||||||
void audit_kex_body(int, char *, char *, char *, pid_t, uid_t);
|
|
||||||
void audit_session_key_free(int ctos);
|
|
||||||
void audit_session_key_free_body(int ctos, pid_t, uid_t);
|
|
||||||
void audit_destroy_sensitive_data(const char *, pid_t, uid_t);
|
|
||||||
void audit_generate_ephemeral_server_key(const char *);
|
|
||||||
+void audit_linux_prng_seed(long, const char *);
|
|
||||||
|
|
||||||
#endif /* _SSH_AUDIT_H */
|
|
||||||
diff --git a/openssh-6.6p1/entropy.c b/openssh-6.6p1/entropy.c
|
|
||||||
--- a/openssh-6.6p1/entropy.c
|
|
||||||
+++ b/openssh-6.6p1/entropy.c
|
|
||||||
@@ -45,16 +45,17 @@
|
|
||||||
|
|
||||||
#include "ssh.h"
|
|
||||||
#include "misc.h"
|
|
||||||
#include "xmalloc.h"
|
|
||||||
#include "atomicio.h"
|
|
||||||
#include "pathnames.h"
|
|
||||||
#include "log.h"
|
|
||||||
#include "buffer.h"
|
|
||||||
+#include "openbsd-compat/port-linux.h"
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Portable OpenSSH PRNG seeding:
|
|
||||||
* If OpenSSL has not "internally seeded" itself (e.g. pulled data from
|
|
||||||
* /dev/random), then collect RANDOM_SEED_SIZE bytes of randomness from
|
|
||||||
* PRNGd.
|
|
||||||
*/
|
|
||||||
#ifndef OPENSSL_PRNG_ONLY
|
|
||||||
@@ -229,11 +230,14 @@ seed_rng(void)
|
|
||||||
}
|
|
||||||
|
|
||||||
if (seed_from_prngd(buf, sizeof(buf)) == -1)
|
|
||||||
fatal("Could not obtain seed from PRNGd");
|
|
||||||
RAND_add(buf, sizeof(buf), sizeof(buf));
|
|
||||||
memset(buf, '\0', sizeof(buf));
|
|
||||||
|
|
||||||
#endif /* OPENSSL_PRNG_ONLY */
|
|
||||||
+
|
|
||||||
+ linux_seed();
|
|
||||||
+
|
|
||||||
if (RAND_status() != 1)
|
|
||||||
fatal("PRNG is not seeded");
|
|
||||||
}
|
|
||||||
diff --git a/openssh-6.6p1/openbsd-compat/Makefile.in b/openssh-6.6p1/openbsd-compat/Makefile.in
|
|
||||||
--- a/openssh-6.6p1/openbsd-compat/Makefile.in
|
|
||||||
+++ b/openssh-6.6p1/openbsd-compat/Makefile.in
|
|
||||||
@@ -15,17 +15,17 @@ AR=@AR@
|
|
||||||
RANLIB=@RANLIB@
|
|
||||||
INSTALL=@INSTALL@
|
|
||||||
LDFLAGS=-L. @LDFLAGS@
|
|
||||||
|
|
||||||
OPENBSD=base64.o basename.o bcrypt_pbkdf.o bindresvport.o blowfish.o daemon.o dirname.o fmt_scaled.o getcwd.o getgrouplist.o getopt_long.o getrrsetbyname.o glob.o inet_aton.o inet_ntoa.o inet_ntop.o mktemp.o pwcache.o readpassphrase.o realpath.o rresvport.o setenv.o setproctitle.o sha2.o sigact.o strlcat.o strlcpy.o strmode.o strnlen.o strptime.o strsep.o strtonum.o strtoll.o strtoul.o strtoull.o timingsafe_bcmp.o vis.o blowfish.o bcrypt_pbkdf.o explicit_bzero.o
|
|
||||||
|
|
||||||
COMPAT=arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o getrrsetbyname-ldns.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-setres_id.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o
|
|
||||||
|
|
||||||
-PORTS=port-aix.o port-irix.o port-linux.o port-solaris.o port-tun.o port-uw.o
|
|
||||||
+PORTS=port-aix.o port-irix.o port-linux.o port-linux-prng.o port-solaris.o port-tun.o port-uw.o
|
|
||||||
|
|
||||||
.c.o:
|
|
||||||
$(CC) $(CFLAGS) $(CPPFLAGS) -c $<
|
|
||||||
|
|
||||||
all: libopenbsd-compat.a
|
|
||||||
|
|
||||||
$(COMPAT): ../config.h
|
|
||||||
$(OPENBSD): ../config.h
|
|
||||||
diff --git a/openssh-6.6p1/openbsd-compat/port-linux-prng.c b/openssh-6.6p1/openbsd-compat/port-linux-prng.c
|
|
||||||
new file mode 100644
|
|
||||||
--- /dev/null
|
|
||||||
+++ b/openssh-6.6p1/openbsd-compat/port-linux-prng.c
|
|
||||||
@@ -0,0 +1,79 @@
|
|
||||||
+/*
|
|
||||||
+ * Copyright (c) 2011 Jan F. Chadima <jchadima@redhat.com>
|
|
||||||
+ * (c) 2011 Petr Cerny <pcerny@suse.cz>
|
|
||||||
+ *
|
|
||||||
+ * Permission to use, copy, modify, and distribute this software for any
|
|
||||||
+ * purpose with or without fee is hereby granted, provided that the above
|
|
||||||
+ * copyright notice and this permission notice appear in all copies.
|
|
||||||
+ *
|
|
||||||
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
|
||||||
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
|
||||||
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
|
|
||||||
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
|
||||||
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
|
||||||
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
|
||||||
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
|
||||||
+ */
|
|
||||||
+
|
|
||||||
+/*
|
|
||||||
+ * Linux-specific portability code - prng support
|
|
||||||
+ */
|
|
||||||
+
|
|
||||||
+#include "includes.h"
|
|
||||||
+#include "defines.h"
|
|
||||||
+
|
|
||||||
+#include <errno.h>
|
|
||||||
+#include <stdarg.h>
|
|
||||||
+#include <string.h>
|
|
||||||
+#include <stdio.h>
|
|
||||||
+#include <openssl/rand.h>
|
|
||||||
+
|
|
||||||
+#include "log.h"
|
|
||||||
+#include "port-linux.h"
|
|
||||||
+#include "audit.h"
|
|
||||||
+
|
|
||||||
+#define RNG_BYTES_DEFAULT 6L
|
|
||||||
+#define RNG_ENV_VAR "SSH_USE_STRONG_RNG"
|
|
||||||
+
|
|
||||||
+long rand_bytes = 0;
|
|
||||||
+char *rand_file = NULL;
|
|
||||||
+
|
|
||||||
+static void
|
|
||||||
+linux_seed_init(void)
|
|
||||||
+{
|
|
||||||
+ long elen = 0;
|
|
||||||
+ char *env = getenv(RNG_ENV_VAR);
|
|
||||||
+
|
|
||||||
+ if (env) {
|
|
||||||
+ errno = 0;
|
|
||||||
+ elen = strtol(env, NULL, 10);
|
|
||||||
+ if (errno) {
|
|
||||||
+ debug("bogus value in the %s environment variable, using default %li\n",
|
|
||||||
+ RNG_ENV_VAR, RNG_BYTES_DEFAULT);
|
|
||||||
+ }
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ if (elen)
|
|
||||||
+ rand_file = "/dev/random";
|
|
||||||
+ else
|
|
||||||
+ rand_file = "/dev/urandom";
|
|
||||||
+
|
|
||||||
+ rand_bytes = MAX(elen, RNG_BYTES_DEFAULT);
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+void
|
|
||||||
+linux_seed(void)
|
|
||||||
+{
|
|
||||||
+ long len;
|
|
||||||
+ if (!rand_file)
|
|
||||||
+ linux_seed_init();
|
|
||||||
+
|
|
||||||
+ errno = 0;
|
|
||||||
+ len = RAND_load_file(rand_file, rand_bytes);
|
|
||||||
+ if (len != rand_bytes) {
|
|
||||||
+ if (errno)
|
|
||||||
+ fatal ("cannot read from %s, %s", random, strerror(errno));
|
|
||||||
+ else
|
|
||||||
+ fatal ("EOF reading %s", random);
|
|
||||||
+ }
|
|
||||||
+}
|
|
||||||
diff --git a/openssh-6.6p1/openbsd-compat/port-linux.h b/openssh-6.6p1/openbsd-compat/port-linux.h
|
|
||||||
--- a/openssh-6.6p1/openbsd-compat/port-linux.h
|
|
||||||
+++ b/openssh-6.6p1/openbsd-compat/port-linux.h
|
|
||||||
@@ -14,16 +14,20 @@
|
|
||||||
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
|
||||||
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
|
||||||
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
|
||||||
*/
|
|
||||||
|
|
||||||
#ifndef _PORT_LINUX_H
|
|
||||||
#define _PORT_LINUX_H
|
|
||||||
|
|
||||||
+extern long rand_bytes;
|
|
||||||
+extern char *rand_file;
|
|
||||||
+void linux_seed(void);
|
|
||||||
+
|
|
||||||
#ifdef WITH_SELINUX
|
|
||||||
int ssh_selinux_enabled(void);
|
|
||||||
void ssh_selinux_setup_pty(char *, const char *);
|
|
||||||
void ssh_selinux_setup_exec_context(char *);
|
|
||||||
void ssh_selinux_change_context(const char *);
|
|
||||||
void ssh_selinux_setfscreatecon(const char *);
|
|
||||||
#endif
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/ssh-add.1 b/openssh-6.6p1/ssh-add.1
|
|
||||||
--- a/openssh-6.6p1/ssh-add.1
|
|
||||||
+++ b/openssh-6.6p1/ssh-add.1
|
|
||||||
@@ -156,16 +156,30 @@ or related script.
|
|
||||||
(Note that on some machines it
|
|
||||||
may be necessary to redirect the input from
|
|
||||||
.Pa /dev/null
|
|
||||||
to make this work.)
|
|
||||||
.It Ev SSH_AUTH_SOCK
|
|
||||||
Identifies the path of a
|
|
||||||
.Ux Ns -domain
|
|
||||||
socket used to communicate with the agent.
|
|
||||||
+.It Ev SSH_USE_STRONG_RNG
|
|
||||||
+The reseeding of the OpenSSL random generator is usually done from
|
|
||||||
+.Cm /dev/urandom .
|
|
||||||
+If the
|
|
||||||
+.Cm SSH_USE_STRONG_RNG
|
|
||||||
+environment variable is set to value other than
|
|
||||||
+.Cm 0
|
|
||||||
+the OpenSSL random generator is reseeded from
|
|
||||||
+.Cm /dev/random .
|
|
||||||
+The number of bytes read is defined by the SSH_USE_STRONG_RNG value.
|
|
||||||
+Minimum is 6 bytes.
|
|
||||||
+This setting is not recommended on the computers without the hardware
|
|
||||||
+random generator because insufficient entropy causes the connection to
|
|
||||||
+be blocked until enough entropy is available.
|
|
||||||
.El
|
|
||||||
.Sh FILES
|
|
||||||
.Bl -tag -width Ds
|
|
||||||
.It Pa ~/.ssh/identity
|
|
||||||
Contains the protocol version 1 RSA authentication identity of the user.
|
|
||||||
.It Pa ~/.ssh/id_dsa
|
|
||||||
Contains the protocol version 2 DSA authentication identity of the user.
|
|
||||||
.It Pa ~/.ssh/id_ecdsa
|
|
||||||
diff --git a/openssh-6.6p1/ssh-agent.1 b/openssh-6.6p1/ssh-agent.1
|
|
||||||
--- a/openssh-6.6p1/ssh-agent.1
|
|
||||||
+++ b/openssh-6.6p1/ssh-agent.1
|
|
||||||
@@ -196,16 +196,33 @@ Contains the protocol version 2 ED25519
|
|
||||||
.It Pa ~/.ssh/id_rsa
|
|
||||||
Contains the protocol version 2 RSA authentication identity of the user.
|
|
||||||
.It Pa $TMPDIR/ssh-XXXXXXXXXX/agent.\*(Ltppid\*(Gt
|
|
||||||
.Ux Ns -domain
|
|
||||||
sockets used to contain the connection to the authentication agent.
|
|
||||||
These sockets should only be readable by the owner.
|
|
||||||
The sockets should get automatically removed when the agent exits.
|
|
||||||
.El
|
|
||||||
+.Sh ENVIRONMENT
|
|
||||||
+.Bl -tag -width Ds -compact
|
|
||||||
+.Pp
|
|
||||||
+.It Pa SSH_USE_STRONG_RNG
|
|
||||||
+The reseeding of the OpenSSL random generator is usually done from
|
|
||||||
+.Cm /dev/urandom .
|
|
||||||
+If the
|
|
||||||
+.Cm SSH_USE_STRONG_RNG
|
|
||||||
+environment variable is set to value other than
|
|
||||||
+.Cm 0
|
|
||||||
+the OpenSSL random generator is reseeded from
|
|
||||||
+.Cm /dev/random .
|
|
||||||
+The number of bytes read is defined by the SSH_USE_STRONG_RNG value.
|
|
||||||
+Minimum is 6 bytes.
|
|
||||||
+This setting is not recommended on the computers without the hardware
|
|
||||||
+random generator because insufficient entropy causes the connection to
|
|
||||||
+be blocked until enough entropy is available.
|
|
||||||
.Sh SEE ALSO
|
|
||||||
.Xr ssh 1 ,
|
|
||||||
.Xr ssh-add 1 ,
|
|
||||||
.Xr ssh-keygen 1 ,
|
|
||||||
.Xr sshd 8
|
|
||||||
.Sh AUTHORS
|
|
||||||
OpenSSH is a derivative of the original and free
|
|
||||||
ssh 1.2.12 release by Tatu Ylonen.
|
|
||||||
diff --git a/openssh-6.6p1/ssh-keygen.1 b/openssh-6.6p1/ssh-keygen.1
|
|
||||||
--- a/openssh-6.6p1/ssh-keygen.1
|
|
||||||
+++ b/openssh-6.6p1/ssh-keygen.1
|
|
||||||
@@ -827,16 +827,33 @@ on all machines
|
|
||||||
where the user wishes to log in using public key authentication.
|
|
||||||
There is no need to keep the contents of this file secret.
|
|
||||||
.Pp
|
|
||||||
.It Pa /etc/moduli
|
|
||||||
Contains Diffie-Hellman groups used for DH-GEX.
|
|
||||||
The file format is described in
|
|
||||||
.Xr moduli 5 .
|
|
||||||
.El
|
|
||||||
+.Sh ENVIRONMENT
|
|
||||||
+.Bl -tag -width Ds -compact
|
|
||||||
+.Pp
|
|
||||||
+.It Pa SSH_USE_STRONG_RNG
|
|
||||||
+The reseeding of the OpenSSL random generator is usually done from
|
|
||||||
+.Cm /dev/urandom .
|
|
||||||
+If the
|
|
||||||
+.Cm SSH_USE_STRONG_RNG
|
|
||||||
+environment variable is set to value other than
|
|
||||||
+.Cm 0
|
|
||||||
+the OpenSSL random generator is reseeded from
|
|
||||||
+.Cm /dev/random .
|
|
||||||
+The number of bytes read is defined by the SSH_USE_STRONG_RNG value.
|
|
||||||
+Minimum is 6 bytes.
|
|
||||||
+This setting is not recommended on the computers without the hardware
|
|
||||||
+random generator because insufficient entropy causes the connection to
|
|
||||||
+be blocked until enough entropy is available.
|
|
||||||
.Sh SEE ALSO
|
|
||||||
.Xr ssh 1 ,
|
|
||||||
.Xr ssh-add 1 ,
|
|
||||||
.Xr ssh-agent 1 ,
|
|
||||||
.Xr moduli 5 ,
|
|
||||||
.Xr sshd 8
|
|
||||||
.Rs
|
|
||||||
.%R RFC 4716
|
|
||||||
diff --git a/openssh-6.6p1/ssh-keysign.8 b/openssh-6.6p1/ssh-keysign.8
|
|
||||||
--- a/openssh-6.6p1/ssh-keysign.8
|
|
||||||
+++ b/openssh-6.6p1/ssh-keysign.8
|
|
||||||
@@ -75,16 +75,33 @@ must be set-uid root if host-based authe
|
|
||||||
.Pp
|
|
||||||
.It Pa /etc/ssh/ssh_host_dsa_key-cert.pub
|
|
||||||
.It Pa /etc/ssh/ssh_host_ecdsa_key-cert.pub
|
|
||||||
.It Pa /etc/ssh/ssh_host_ed25519_key-cert.pub
|
|
||||||
.It Pa /etc/ssh/ssh_host_rsa_key-cert.pub
|
|
||||||
If these files exist they are assumed to contain public certificate
|
|
||||||
information corresponding with the private keys above.
|
|
||||||
.El
|
|
||||||
+.Sh ENVIRONMENT
|
|
||||||
+.Bl -tag -width Ds -compact
|
|
||||||
+.Pp
|
|
||||||
+.It Pa SSH_USE_STRONG_RNG
|
|
||||||
+The reseeding of the OpenSSL random generator is usually done from
|
|
||||||
+.Cm /dev/urandom .
|
|
||||||
+If the
|
|
||||||
+.Cm SSH_USE_STRONG_RNG
|
|
||||||
+environment variable is set to value other than
|
|
||||||
+.Cm 0
|
|
||||||
+the OpenSSL random generator is reseeded from
|
|
||||||
+.Cm /dev/random .
|
|
||||||
+The number of bytes read is defined by the SSH_USE_STRONG_RNG value.
|
|
||||||
+Minimum is 6 bytes.
|
|
||||||
+This setting is not recommended on the computers without the hardware
|
|
||||||
+random generator because insufficient entropy causes the connection to
|
|
||||||
+be blocked until enough entropy is available.
|
|
||||||
.Sh SEE ALSO
|
|
||||||
.Xr ssh 1 ,
|
|
||||||
.Xr ssh-keygen 1 ,
|
|
||||||
.Xr ssh_config 5 ,
|
|
||||||
.Xr sshd 8
|
|
||||||
.Sh HISTORY
|
|
||||||
.Nm
|
|
||||||
first appeared in
|
|
||||||
diff --git a/openssh-6.6p1/ssh.1 b/openssh-6.6p1/ssh.1
|
|
||||||
--- a/openssh-6.6p1/ssh.1
|
|
||||||
+++ b/openssh-6.6p1/ssh.1
|
|
||||||
@@ -1304,16 +1304,30 @@ reads
|
|
||||||
and adds lines of the format
|
|
||||||
.Dq VARNAME=value
|
|
||||||
to the environment if the file exists and users are allowed to
|
|
||||||
change their environment.
|
|
||||||
For more information, see the
|
|
||||||
.Cm PermitUserEnvironment
|
|
||||||
option in
|
|
||||||
.Xr sshd_config 5 .
|
|
||||||
+.It Ev SSH_USE_STRONG_RNG
|
|
||||||
+The reseeding of the OpenSSL random generator is usually done from
|
|
||||||
+.Cm /dev/urandom .
|
|
||||||
+If the
|
|
||||||
+.Cm SSH_USE_STRONG_RNG
|
|
||||||
+environment variable is set to value other than
|
|
||||||
+.Cm 0
|
|
||||||
+the OpenSSL random generator is reseeded from
|
|
||||||
+.Cm /dev/random .
|
|
||||||
+The number of bytes read is defined by the SSH_USE_STRONG_RNG value.
|
|
||||||
+Minimum is 6 bytes.
|
|
||||||
+This setting is not recommended on the computers without the hardware
|
|
||||||
+random generator because insufficient entropy causes the connection to
|
|
||||||
+be blocked until enough entropy is available.
|
|
||||||
.Sh FILES
|
|
||||||
.Bl -tag -width Ds -compact
|
|
||||||
.It Pa ~/.rhosts
|
|
||||||
This file is used for host-based authentication (see above).
|
|
||||||
On some machines this file may need to be
|
|
||||||
world-readable if the user's home directory is on an NFS partition,
|
|
||||||
because
|
|
||||||
.Xr sshd 8
|
|
||||||
diff --git a/openssh-6.6p1/sshd.8 b/openssh-6.6p1/sshd.8
|
|
||||||
--- a/openssh-6.6p1/sshd.8
|
|
||||||
+++ b/openssh-6.6p1/sshd.8
|
|
||||||
@@ -946,16 +946,33 @@ and not group or world-writable.
|
|
||||||
.It Pa /var/run/sshd.pid
|
|
||||||
Contains the process ID of the
|
|
||||||
.Nm
|
|
||||||
listening for connections (if there are several daemons running
|
|
||||||
concurrently for different ports, this contains the process ID of the one
|
|
||||||
started last).
|
|
||||||
The content of this file is not sensitive; it can be world-readable.
|
|
||||||
.El
|
|
||||||
+.Sh ENVIRONMENT
|
|
||||||
+.Bl -tag -width Ds -compact
|
|
||||||
+.Pp
|
|
||||||
+.It Pa SSH_USE_STRONG_RNG
|
|
||||||
+The reseeding of the OpenSSL random generator is usually done from
|
|
||||||
+.Cm /dev/urandom .
|
|
||||||
+If the
|
|
||||||
+.Cm SSH_USE_STRONG_RNG
|
|
||||||
+environment variable is set to value other than
|
|
||||||
+.Cm 0
|
|
||||||
+the OpenSSL random generator is reseeded from
|
|
||||||
+.Cm /dev/random .
|
|
||||||
+The number of bytes read is defined by the SSH_USE_STRONG_RNG value.
|
|
||||||
+Minimum is 6 bytes.
|
|
||||||
+This setting is not recommended on the computers without the hardware
|
|
||||||
+random generator because insufficient entropy causes the connection to
|
|
||||||
+be blocked until enough entropy is available.
|
|
||||||
.Sh SEE ALSO
|
|
||||||
.Xr scp 1 ,
|
|
||||||
.Xr sftp 1 ,
|
|
||||||
.Xr ssh 1 ,
|
|
||||||
.Xr ssh-add 1 ,
|
|
||||||
.Xr ssh-agent 1 ,
|
|
||||||
.Xr ssh-keygen 1 ,
|
|
||||||
.Xr ssh-keyscan 1 ,
|
|
||||||
diff --git a/openssh-6.6p1/sshd.c b/openssh-6.6p1/sshd.c
|
|
||||||
--- a/openssh-6.6p1/sshd.c
|
|
||||||
+++ b/openssh-6.6p1/sshd.c
|
|
||||||
@@ -50,16 +50,18 @@
|
|
||||||
#ifdef HAVE_SYS_STAT_H
|
|
||||||
# include <sys/stat.h>
|
|
||||||
#endif
|
|
||||||
#ifdef HAVE_SYS_TIME_H
|
|
||||||
# include <sys/time.h>
|
|
||||||
#endif
|
|
||||||
#include "openbsd-compat/sys-tree.h"
|
|
||||||
#include "openbsd-compat/sys-queue.h"
|
|
||||||
+#include "openbsd-compat/port-linux.h"
|
|
||||||
+
|
|
||||||
#include <sys/wait.h>
|
|
||||||
|
|
||||||
#include <errno.h>
|
|
||||||
#include <fcntl.h>
|
|
||||||
#include <netdb.h>
|
|
||||||
#ifdef HAVE_PATHS_H
|
|
||||||
#include <paths.h>
|
|
||||||
#endif
|
|
||||||
@@ -218,16 +220,23 @@ struct {
|
|
||||||
Key **host_pubkeys; /* all public host keys */
|
|
||||||
Key **host_certificates; /* all public host certificates */
|
|
||||||
int have_ssh1_key;
|
|
||||||
int have_ssh2_key;
|
|
||||||
u_char ssh1_cookie[SSH_SESSION_KEY_LENGTH];
|
|
||||||
} sensitive_data;
|
|
||||||
|
|
||||||
/*
|
|
||||||
+ * Every RESEED_AFTERth connection triggers call to linux_seed() to re-seed the
|
|
||||||
+ * random pool.
|
|
||||||
+ */
|
|
||||||
+#define RESEED_AFTER 100
|
|
||||||
+static int re_seeding_counter = RESEED_AFTER;
|
|
||||||
+
|
|
||||||
+/*
|
|
||||||
* Flag indicating whether the RSA server key needs to be regenerated.
|
|
||||||
* Is set in the SIGALRM handler and cleared when the key is regenerated.
|
|
||||||
*/
|
|
||||||
static volatile sig_atomic_t key_do_regen = 0;
|
|
||||||
|
|
||||||
/* This is set to true when a signal is received. */
|
|
||||||
static volatile sig_atomic_t received_sighup = 0;
|
|
||||||
static volatile sig_atomic_t received_sigterm = 0;
|
|
||||||
@@ -1322,16 +1331,21 @@ server_accept_loop(int *sock_in, int *so
|
|
||||||
for (j = 0; j < options.max_startups; j++)
|
|
||||||
if (startup_pipes[j] == -1) {
|
|
||||||
startup_pipes[j] = startup_p[0];
|
|
||||||
if (maxfd < startup_p[0])
|
|
||||||
maxfd = startup_p[0];
|
|
||||||
startups++;
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
+ if(!(--re_seeding_counter)) {
|
|
||||||
+ re_seeding_counter = RESEED_AFTER;
|
|
||||||
+ linux_seed();
|
|
||||||
+ audit_linux_prng_seed(rand_bytes, rand_file);
|
|
||||||
+ }
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Got connection. Fork a child to handle it, unless
|
|
||||||
* we are in debugging mode.
|
|
||||||
*/
|
|
||||||
if (debug_flag) {
|
|
||||||
/*
|
|
||||||
* In debugging mode. Close the listening
|
|
@ -1,44 +0,0 @@
|
|||||||
# send locales in default configuration
|
|
||||||
# bnc#65747
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/ssh_config b/openssh-6.6p1/ssh_config
|
|
||||||
--- a/openssh-6.6p1/ssh_config
|
|
||||||
+++ b/openssh-6.6p1/ssh_config
|
|
||||||
@@ -58,9 +58,14 @@ ForwardX11Trusted yes
|
|
||||||
# ProxyCommand ssh -q -W %h:%p gateway.example.com
|
|
||||||
|
|
||||||
# Set this to 'yes' to enable support for the deprecated 'gssapi' authentication
|
|
||||||
# mechanism to OpenSSH 3.8p1. The newer 'gssapi-with-mic' mechanism is included
|
|
||||||
# in this release. The use of 'gssapi' is deprecated due to the presence of
|
|
||||||
# potential man-in-the-middle attacks, which 'gssapi-with-mic' is not susceptible to.
|
|
||||||
# GSSAPIEnableMITMAttack no
|
|
||||||
|
|
||||||
+# This enables sending locale enviroment variables LC_* LANG, see ssh_config(5).
|
|
||||||
+SendEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
|
|
||||||
+SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
|
|
||||||
+SendEnv LC_IDENTIFICATION LC_ALL
|
|
||||||
+
|
|
||||||
# RekeyLimit 1G 1h
|
|
||||||
diff --git a/openssh-6.6p1/sshd_config b/openssh-6.6p1/sshd_config
|
|
||||||
--- a/openssh-6.6p1/sshd_config
|
|
||||||
+++ b/openssh-6.6p1/sshd_config
|
|
||||||
@@ -127,14 +127,19 @@ UsePrivilegeSeparation sandbox # Defaul
|
|
||||||
#VersionAddendum none
|
|
||||||
|
|
||||||
# no default banner path
|
|
||||||
#Banner none
|
|
||||||
|
|
||||||
# override default of no subsystems
|
|
||||||
Subsystem sftp /usr/libexec/sftp-server
|
|
||||||
|
|
||||||
+# This enables accepting locale enviroment variables LC_* LANG, see sshd_config(5).
|
|
||||||
+AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
|
|
||||||
+AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
|
|
||||||
+AcceptEnv LC_IDENTIFICATION LC_ALL
|
|
||||||
+
|
|
||||||
# Example of overriding settings on a per-user basis
|
|
||||||
#Match User anoncvs
|
|
||||||
# X11Forwarding no
|
|
||||||
# AllowTcpForwarding no
|
|
||||||
# PermitTTY no
|
|
||||||
# ForceCommand cvs server
|
|
@ -1,155 +0,0 @@
|
|||||||
# additional option for sftp-server to force file mode for new files
|
|
||||||
# FATE#312774
|
|
||||||
# http://lists.mindrot.org/pipermail/openssh-unix-dev/2010-November/029044.html
|
|
||||||
# http://marc.info/?l=openssh-unix-dev&m=128896838930893
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/sftp-server.8 b/openssh-6.6p1/sftp-server.8
|
|
||||||
--- a/openssh-6.6p1/sftp-server.8
|
|
||||||
+++ b/openssh-6.6p1/sftp-server.8
|
|
||||||
@@ -33,16 +33,17 @@
|
|
||||||
.Bk -words
|
|
||||||
.Op Fl ehR
|
|
||||||
.Op Fl d Ar start_directory
|
|
||||||
.Op Fl f Ar log_facility
|
|
||||||
.Op Fl l Ar log_level
|
|
||||||
.Op Fl P Ar blacklisted_requests
|
|
||||||
.Op Fl p Ar whitelisted_requests
|
|
||||||
.Op Fl u Ar umask
|
|
||||||
+.Op Fl m Ar force_file_permissions
|
|
||||||
.Ek
|
|
||||||
.Nm
|
|
||||||
.Fl Q Ar protocol_feature
|
|
||||||
.Sh DESCRIPTION
|
|
||||||
.Nm
|
|
||||||
is a program that speaks the server side of SFTP protocol
|
|
||||||
to stdout and expects client requests from stdin.
|
|
||||||
.Nm
|
|
||||||
@@ -133,16 +134,20 @@ Places this instance of
|
|
||||||
into a read-only mode.
|
|
||||||
Attempts to open files for writing, as well as other operations that change
|
|
||||||
the state of the filesystem, will be denied.
|
|
||||||
.It Fl u Ar umask
|
|
||||||
Sets an explicit
|
|
||||||
.Xr umask 2
|
|
||||||
to be applied to newly-created files and directories, instead of the
|
|
||||||
user's default mask.
|
|
||||||
+.It Fl m Ar force_file_permissions
|
|
||||||
+Sets explicit file permissions to be applied to newly-created files instead
|
|
||||||
+of the default or client requested mode. Numeric values include:
|
|
||||||
+777, 755, 750, 666, 644, 640, etc. Option -u is ineffective if -m is set.
|
|
||||||
.El
|
|
||||||
.Pp
|
|
||||||
For logging to work,
|
|
||||||
.Nm
|
|
||||||
must be able to access
|
|
||||||
.Pa /dev/log .
|
|
||||||
Use of
|
|
||||||
.Nm
|
|
||||||
diff --git a/openssh-6.6p1/sftp-server.c b/openssh-6.6p1/sftp-server.c
|
|
||||||
--- a/openssh-6.6p1/sftp-server.c
|
|
||||||
+++ b/openssh-6.6p1/sftp-server.c
|
|
||||||
@@ -75,16 +75,20 @@ static u_int version;
|
|
||||||
static int init_done;
|
|
||||||
|
|
||||||
/* Disable writes */
|
|
||||||
static int readonly;
|
|
||||||
|
|
||||||
/* Requests that are allowed/denied */
|
|
||||||
static char *request_whitelist, *request_blacklist;
|
|
||||||
|
|
||||||
+/* Force file permissions */
|
|
||||||
+int permforce = 0;
|
|
||||||
+long permforcemode;
|
|
||||||
+
|
|
||||||
/* portable attributes, etc. */
|
|
||||||
typedef struct Stat Stat;
|
|
||||||
|
|
||||||
struct Stat {
|
|
||||||
char *name;
|
|
||||||
char *long_name;
|
|
||||||
Attrib attrib;
|
|
||||||
};
|
|
||||||
@@ -670,16 +674,20 @@ process_open(u_int32_t id)
|
|
||||||
int handle, fd, flags, mode, status = SSH2_FX_FAILURE;
|
|
||||||
|
|
||||||
name = get_string(NULL);
|
|
||||||
pflags = get_int(); /* portable flags */
|
|
||||||
debug3("request %u: open flags %d", id, pflags);
|
|
||||||
a = get_attrib();
|
|
||||||
flags = flags_from_portable(pflags);
|
|
||||||
mode = (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ? a->perm : 0666;
|
|
||||||
+ if (permforce == 1) {
|
|
||||||
+ mode = permforcemode;
|
|
||||||
+ (void)umask(0); /* so umask does not interfere */
|
|
||||||
+ }
|
|
||||||
logit("open \"%s\" flags %s mode 0%o",
|
|
||||||
name, string_from_portable(pflags), mode);
|
|
||||||
if (readonly &&
|
|
||||||
((flags & O_ACCMODE) == O_WRONLY ||
|
|
||||||
(flags & O_ACCMODE) == O_RDWR)) {
|
|
||||||
verbose("Refusing open request in read-only mode");
|
|
||||||
status = SSH2_FX_PERMISSION_DENIED;
|
|
||||||
} else {
|
|
||||||
@@ -1425,17 +1433,18 @@ sftp_server_cleanup_exit(int i)
|
|
||||||
static void
|
|
||||||
sftp_server_usage(void)
|
|
||||||
{
|
|
||||||
extern char *__progname;
|
|
||||||
|
|
||||||
fprintf(stderr,
|
|
||||||
"usage: %s [-ehR] [-d start_directory] [-f log_facility] "
|
|
||||||
"[-l log_level]\n\t[-P blacklisted_requests] "
|
|
||||||
- "[-p whitelisted_requests] [-u umask]\n"
|
|
||||||
+ "[-p whitelisted_requests] [-u umask]\n\t"
|
|
||||||
+ "[-m force_file_permissions]\n",
|
|
||||||
" %s -Q protocol_feature\n",
|
|
||||||
__progname, __progname);
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
int
|
|
||||||
sftp_server_main(int argc, char **argv, struct passwd *user_pw)
|
|
||||||
{
|
|
||||||
@@ -1450,17 +1459,17 @@ sftp_server_main(int argc, char **argv,
|
|
||||||
extern char *__progname;
|
|
||||||
|
|
||||||
__progname = ssh_get_progname(argv[0]);
|
|
||||||
log_init(__progname, log_level, log_facility, log_stderr);
|
|
||||||
|
|
||||||
pw = pwcopy(user_pw);
|
|
||||||
|
|
||||||
while (!skipargs && (ch = getopt(argc, argv,
|
|
||||||
- "d:f:l:P:p:Q:u:cehR")) != -1) {
|
|
||||||
+ "d:f:l:P:p:Q:u:m:cehR")) != -1) {
|
|
||||||
switch (ch) {
|
|
||||||
case 'Q':
|
|
||||||
if (strcasecmp(optarg, "requests") != 0) {
|
|
||||||
fprintf(stderr, "Invalid query type\n");
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
for (i = 0; handlers[i].handler != NULL; i++)
|
|
||||||
printf("%s\n", handlers[i].name);
|
|
||||||
@@ -1510,16 +1519,23 @@ sftp_server_main(int argc, char **argv,
|
|
||||||
case 'u':
|
|
||||||
errno = 0;
|
|
||||||
mask = strtol(optarg, &cp, 8);
|
|
||||||
if (mask < 0 || mask > 0777 || *cp != '\0' ||
|
|
||||||
cp == optarg || (mask == 0 && errno != 0))
|
|
||||||
fatal("Invalid umask \"%s\"", optarg);
|
|
||||||
(void)umask((mode_t)mask);
|
|
||||||
break;
|
|
||||||
+ case 'm':
|
|
||||||
+ permforce = 1;
|
|
||||||
+ permforcemode = strtol(optarg, &cp, 8);
|
|
||||||
+ if (permforcemode < 0 || permforcemode > 0777 || *cp != '\0' ||
|
|
||||||
+ cp == optarg || (permforcemode == 0 && errno != 0))
|
|
||||||
+ fatal("Invalid umask \"%s\"", optarg);
|
|
||||||
+ break;
|
|
||||||
case 'h':
|
|
||||||
default:
|
|
||||||
sftp_server_usage();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
log_init(__progname, log_level, log_facility, log_stderr);
|
|
||||||
|
|
@ -1,373 +0,0 @@
|
|||||||
# run sftp sessions inside a chroot
|
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/session.c b/openssh-6.6p1/session.c
|
|
||||||
--- a/openssh-6.6p1/session.c
|
|
||||||
+++ b/openssh-6.6p1/session.c
|
|
||||||
@@ -120,16 +120,18 @@ int do_exec(Session *, const char *);
|
|
||||||
void do_login(Session *, const char *);
|
|
||||||
#ifdef LOGIN_NEEDS_UTMPX
|
|
||||||
static void do_pre_login(Session *s);
|
|
||||||
#endif
|
|
||||||
void do_child(Session *, const char *);
|
|
||||||
void do_motd(void);
|
|
||||||
int check_quietlogin(Session *, const char *);
|
|
||||||
|
|
||||||
+int chroot_no_tree = 0;
|
|
||||||
+
|
|
||||||
static void do_authenticated1(Authctxt *);
|
|
||||||
static void do_authenticated2(Authctxt *);
|
|
||||||
|
|
||||||
static int session_pty_req(Session *);
|
|
||||||
|
|
||||||
/* import */
|
|
||||||
extern ServerOptions options;
|
|
||||||
extern char *__progname;
|
|
||||||
@@ -827,16 +829,21 @@ do_exec(Session *s, const char *command)
|
|
||||||
"subsystem '%.900s'", s->subsys);
|
|
||||||
} else if (command == NULL) {
|
|
||||||
snprintf(session_type, sizeof(session_type), "shell");
|
|
||||||
} else {
|
|
||||||
/* NB. we don't log unforced commands to preserve privacy */
|
|
||||||
snprintf(session_type, sizeof(session_type), "command");
|
|
||||||
}
|
|
||||||
|
|
||||||
+ if ((s->is_subsystem != SUBSYSTEM_INT_SFTP) && chroot_no_tree) {
|
|
||||||
+ logit("You aren't welcomed, go away!");
|
|
||||||
+ exit (1);
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
if (s->ttyfd != -1) {
|
|
||||||
tty = s->tty;
|
|
||||||
if (strncmp(tty, "/dev/", 5) == 0)
|
|
||||||
tty += 5;
|
|
||||||
}
|
|
||||||
|
|
||||||
verbose("Starting session: %s%s%s for %s from %.200s port %d",
|
|
||||||
session_type,
|
|
||||||
@@ -1463,67 +1470,132 @@ do_nologin(struct passwd *pw)
|
|
||||||
while (fgets(buf, sizeof(buf), f))
|
|
||||||
fputs(buf, stderr);
|
|
||||||
fclose(f);
|
|
||||||
}
|
|
||||||
exit(254);
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
+ * Test if filesystem is mounted nosuid and nodev
|
|
||||||
+ */
|
|
||||||
+
|
|
||||||
+static void
|
|
||||||
+test_nosuid (char * path, dev_t fs)
|
|
||||||
+{
|
|
||||||
+ FILE *f;
|
|
||||||
+ struct stat st;
|
|
||||||
+ char buf[4096], *s, *on, *mountpoint, *opt;
|
|
||||||
+ int nodev, nosuid;
|
|
||||||
+
|
|
||||||
+ if (!(f = popen ("/bin/mount", "r")))
|
|
||||||
+ fatal ("%s: popen(\"/bin/mount\", \"r\"): %s",
|
|
||||||
+ __func__, strerror (errno));
|
|
||||||
+ for (;;) {
|
|
||||||
+ s = fgets (buf, sizeof (buf), f);
|
|
||||||
+ if (ferror (f))
|
|
||||||
+ fatal ("%s: read from popen: %s", __func__,
|
|
||||||
+ strerror (errno));
|
|
||||||
+ if (!s) {
|
|
||||||
+ pclose (f);
|
|
||||||
+ fatal ("cannot find filesystem with the chroot directory");
|
|
||||||
+ }
|
|
||||||
+ (void) strtok (buf, " ");
|
|
||||||
+ on = strtok (NULL, " ");
|
|
||||||
+ if (strcmp (on, "on")) {
|
|
||||||
+ pclose (f);
|
|
||||||
+ fatal ("bad format of mount output");
|
|
||||||
+ }
|
|
||||||
+ mountpoint = strtok (NULL, " ");
|
|
||||||
+ if (memcmp (path, mountpoint, strlen (mountpoint)))
|
|
||||||
+ continue;
|
|
||||||
+ if (stat(mountpoint, &st) != 0) {
|
|
||||||
+ pclose (f);
|
|
||||||
+ fatal("%s: stat(\"%s\"): %s", __func__,
|
|
||||||
+ mountpoint, strerror(errno));
|
|
||||||
+ }
|
|
||||||
+ if (fs != st.st_dev)
|
|
||||||
+ continue;
|
|
||||||
+ nodev = nosuid = 0;
|
|
||||||
+ for (opt = strtok (NULL, "("); opt; opt = strtok (NULL, " ,)")) {
|
|
||||||
+ if (!strcmp (opt, "nodev"))
|
|
||||||
+ nodev = 1;
|
|
||||||
+ else if (!strcmp (opt, "nosuid"))
|
|
||||||
+ nosuid = 1;
|
|
||||||
+ else if (!strcmp (opt, "noexec"))
|
|
||||||
+ nosuid = 1;
|
|
||||||
+ if (nodev && nosuid) {
|
|
||||||
+ pclose (f);
|
|
||||||
+ return;
|
|
||||||
+ }
|
|
||||||
+ }
|
|
||||||
+ fatal ("chroot into directory without nodev and either noexec or nosuid");
|
|
||||||
+ }
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+/*
|
|
||||||
* Chroot into a directory after checking it for safety: all path components
|
|
||||||
* must be root-owned directories with strict permissions.
|
|
||||||
*/
|
|
||||||
static void
|
|
||||||
safely_chroot(const char *path, uid_t uid)
|
|
||||||
{
|
|
||||||
const char *cp;
|
|
||||||
char component[MAXPATHLEN];
|
|
||||||
struct stat st;
|
|
||||||
+ int last;
|
|
||||||
|
|
||||||
if (*path != '/')
|
|
||||||
fatal("chroot path does not begin at root");
|
|
||||||
if (strlen(path) >= sizeof(component))
|
|
||||||
fatal("chroot path too long");
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Descend the path, checking that each component is a
|
|
||||||
* root-owned directory with strict permissions.
|
|
||||||
*/
|
|
||||||
for (cp = path; cp != NULL;) {
|
|
||||||
- if ((cp = strchr(cp, '/')) == NULL)
|
|
||||||
+ if (((last = ((cp = strchr(cp, '/')) == NULL))))
|
|
||||||
strlcpy(component, path, sizeof(component));
|
|
||||||
else {
|
|
||||||
cp++;
|
|
||||||
memcpy(component, path, cp - path);
|
|
||||||
component[cp - path] = '\0';
|
|
||||||
}
|
|
||||||
|
|
||||||
debug3("%s: checking '%s'", __func__, component);
|
|
||||||
|
|
||||||
if (stat(component, &st) != 0)
|
|
||||||
fatal("%s: stat(\"%s\"): %s", __func__,
|
|
||||||
component, strerror(errno));
|
|
||||||
- if (st.st_uid != 0 || (st.st_mode & 022) != 0)
|
|
||||||
+ if ((st.st_uid != 0 || (st.st_mode & 022) != 0) && !(last && st.st_uid == uid))
|
|
||||||
fatal("bad ownership or modes for chroot "
|
|
||||||
"directory %s\"%s\"",
|
|
||||||
cp == NULL ? "" : "component ", component);
|
|
||||||
if (!S_ISDIR(st.st_mode))
|
|
||||||
fatal("chroot path %s\"%s\" is not a directory",
|
|
||||||
cp == NULL ? "" : "component ", component);
|
|
||||||
-
|
|
||||||
+ }
|
|
||||||
+ setenv ("TZ", "/etc/localtime", 0);
|
|
||||||
+ tzset();
|
|
||||||
+
|
|
||||||
+ if (st.st_uid) {
|
|
||||||
+ test_nosuid(path, st.st_dev);
|
|
||||||
+ ++chroot_no_tree;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (chdir(path) == -1)
|
|
||||||
fatal("Unable to chdir to chroot path \"%s\": "
|
|
||||||
"%s", path, strerror(errno));
|
|
||||||
if (chroot(path) == -1)
|
|
||||||
fatal("chroot(\"%s\"): %s", path, strerror(errno));
|
|
||||||
if (chdir("/") == -1)
|
|
||||||
fatal("%s: chdir(/) after chroot: %s",
|
|
||||||
__func__, strerror(errno));
|
|
||||||
+
|
|
||||||
verbose("Changed root directory to \"%s\"", path);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* Set login name, uid, gid, and groups. */
|
|
||||||
void
|
|
||||||
do_setusercontext(struct passwd *pw)
|
|
||||||
{
|
|
||||||
char *chroot_path, *tmp;
|
|
||||||
diff --git a/openssh-6.6p1/sftp-chrootenv.h b/openssh-6.6p1/sftp-chrootenv.h
|
|
||||||
new file mode 100644
|
|
||||||
--- /dev/null
|
|
||||||
+++ b/openssh-6.6p1/sftp-chrootenv.h
|
|
||||||
@@ -0,0 +1,30 @@
|
|
||||||
+/*
|
|
||||||
+ * Copyright (c) 2009 Jan F Chadima. All rights reserved.
|
|
||||||
+ *
|
|
||||||
+ * Redistribution and use in source and binary forms, with or without
|
|
||||||
+ * modification, are permitted provided that the following conditions
|
|
||||||
+ * are met:
|
|
||||||
+ * 1. Redistributions of source code must retain the above copyright
|
|
||||||
+ * notice, this list of conditions and the following disclaimer.
|
|
||||||
+ * 2. Redistributions in binary form must reproduce the above copyright
|
|
||||||
+ * notice, this list of conditions and the following disclaimer in the
|
|
||||||
+ * documentation and/or other materials provided with the distribution.
|
|
||||||
+ *
|
|
||||||
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
|
|
||||||
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
|
||||||
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
|
|
||||||
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
|
|
||||||
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
|
||||||
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
|
||||||
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
||||||
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
|
||||||
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
|
||||||
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
||||||
+ */
|
|
||||||
+#ifndef CHROOTENV_H
|
|
||||||
+#define CHROOTENV_H
|
|
||||||
+
|
|
||||||
+extern int chroot_no_tree;
|
|
||||||
+
|
|
||||||
+#endif
|
|
||||||
+
|
|
||||||
diff --git a/openssh-6.6p1/sftp-common.c b/openssh-6.6p1/sftp-common.c
|
|
||||||
--- a/openssh-6.6p1/sftp-common.c
|
|
||||||
+++ b/openssh-6.6p1/sftp-common.c
|
|
||||||
@@ -42,16 +42,17 @@
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#include "xmalloc.h"
|
|
||||||
#include "buffer.h"
|
|
||||||
#include "log.h"
|
|
||||||
|
|
||||||
#include "sftp.h"
|
|
||||||
#include "sftp-common.h"
|
|
||||||
+#include "sftp-chrootenv.h"
|
|
||||||
|
|
||||||
/* Clear contents of attributes structure */
|
|
||||||
void
|
|
||||||
attrib_clear(Attrib *a)
|
|
||||||
{
|
|
||||||
a->flags = 0;
|
|
||||||
a->size = 0;
|
|
||||||
a->uid = 0;
|
|
||||||
@@ -193,23 +194,23 @@ ls_file(const char *name, const struct s
|
|
||||||
int ulen, glen, sz = 0;
|
|
||||||
struct tm *ltime = localtime(&st->st_mtime);
|
|
||||||
char *user, *group;
|
|
||||||
char buf[1024], mode[11+1], tbuf[12+1], ubuf[11+1], gbuf[11+1];
|
|
||||||
char sbuf[FMT_SCALED_STRSIZE];
|
|
||||||
time_t now;
|
|
||||||
|
|
||||||
strmode(st->st_mode, mode);
|
|
||||||
- if (!remote) {
|
|
||||||
+ if (!remote && !chroot_no_tree) {
|
|
||||||
user = user_from_uid(st->st_uid, 0);
|
|
||||||
} else {
|
|
||||||
snprintf(ubuf, sizeof ubuf, "%u", (u_int)st->st_uid);
|
|
||||||
user = ubuf;
|
|
||||||
}
|
|
||||||
- if (!remote) {
|
|
||||||
+ if (!remote && !chroot_no_tree) {
|
|
||||||
group = group_from_gid(st->st_gid, 0);
|
|
||||||
} else {
|
|
||||||
snprintf(gbuf, sizeof gbuf, "%u", (u_int)st->st_gid);
|
|
||||||
group = gbuf;
|
|
||||||
}
|
|
||||||
if (ltime != NULL) {
|
|
||||||
now = time(NULL);
|
|
||||||
if (now - (365*24*60*60)/2 < st->st_mtime &&
|
|
||||||
diff --git a/openssh-6.6p1/sftp-server-main.c b/openssh-6.6p1/sftp-server-main.c
|
|
||||||
--- a/openssh-6.6p1/sftp-server-main.c
|
|
||||||
+++ b/openssh-6.6p1/sftp-server-main.c
|
|
||||||
@@ -17,21 +17,24 @@
|
|
||||||
|
|
||||||
#include "includes.h"
|
|
||||||
|
|
||||||
#include <sys/types.h>
|
|
||||||
#include <pwd.h>
|
|
||||||
#include <stdarg.h>
|
|
||||||
#include <stdio.h>
|
|
||||||
#include <unistd.h>
|
|
||||||
+#include <time.h>
|
|
||||||
|
|
||||||
#include "log.h"
|
|
||||||
#include "sftp.h"
|
|
||||||
#include "misc.h"
|
|
||||||
|
|
||||||
+int chroot_no_tree = 0;
|
|
||||||
+
|
|
||||||
void
|
|
||||||
cleanup_exit(int i)
|
|
||||||
{
|
|
||||||
sftp_server_cleanup_exit(i);
|
|
||||||
}
|
|
||||||
|
|
||||||
int
|
|
||||||
main(int argc, char **argv)
|
|
||||||
diff --git a/openssh-6.6p1/sftp.c b/openssh-6.6p1/sftp.c
|
|
||||||
--- a/openssh-6.6p1/sftp.c
|
|
||||||
+++ b/openssh-6.6p1/sftp.c
|
|
||||||
@@ -109,16 +109,18 @@ struct complete_ctx {
|
|
||||||
char **remote_pathp;
|
|
||||||
};
|
|
||||||
|
|
||||||
int remote_glob(struct sftp_conn *, const char *, int,
|
|
||||||
int (*)(const char *, int), glob_t *); /* proto for sftp-glob.c */
|
|
||||||
|
|
||||||
extern char *__progname;
|
|
||||||
|
|
||||||
+int chroot_no_tree = 0;
|
|
||||||
+
|
|
||||||
/* Separators for interactive commands */
|
|
||||||
#define WHITESPACE " \t\r\n"
|
|
||||||
|
|
||||||
/* ls flags */
|
|
||||||
#define LS_LONG_VIEW 0x0001 /* Full view ala ls -l */
|
|
||||||
#define LS_SHORT_VIEW 0x0002 /* Single row view ala ls -1 */
|
|
||||||
#define LS_NUMERIC_VIEW 0x0004 /* Long view with numeric uid/gid */
|
|
||||||
#define LS_NAME_SORT 0x0008 /* Sort by name (default) */
|
|
||||||
diff --git a/openssh-6.6p1/sshd_config.0 b/openssh-6.6p1/sshd_config.0
|
|
||||||
--- a/openssh-6.6p1/sshd_config.0
|
|
||||||
+++ b/openssh-6.6p1/sshd_config.0
|
|
||||||
@@ -189,16 +189,24 @@ DESCRIPTION
|
|
||||||
session this requires at least a shell, typically sh(1), and
|
|
||||||
basic /dev nodes such as null(4), zero(4), stdin(4), stdout(4),
|
|
||||||
stderr(4), arandom(4) and tty(4) devices. For file transfer
|
|
||||||
sessions using ``sftp'', no additional configuration of the
|
|
||||||
environment is necessary if the in-process sftp server is used,
|
|
||||||
though sessions which use logging do require /dev/log inside the
|
|
||||||
chroot directory (see sftp-server(8) for details).
|
|
||||||
|
|
||||||
+ In the special case when only sftp is used, not ssh nor scp, it
|
|
||||||
+ is possible to use ChrootDirectory %h or ChrootDirectory
|
|
||||||
+ /some/path/%u. The file system containing this directory must be
|
|
||||||
+ mounted with options nodev and either nosuid or noexec. The owner
|
|
||||||
+ of the directory should be the user. The ownership of the other
|
|
||||||
+ components of the path must fulfill the usual conditions. No adi-
|
|
||||||
+ tional files are required to be present in the directory.
|
|
||||||
+
|
|
||||||
The default is not to chroot(2).
|
|
||||||
|
|
||||||
Ciphers
|
|
||||||
Specifies the ciphers allowed for protocol version 2. Multiple
|
|
||||||
ciphers must be comma-separated. The supported ciphers are:
|
|
||||||
|
|
||||||
``3des-cbc'', ``aes128-cbc'', ``aes192-cbc'', ``aes256-cbc'',
|
|
||||||
``aes128-ctr'', ``aes192-ctr'', ``aes256-ctr'',
|
|
||||||
diff --git a/openssh-6.6p1/sshd_config.5 b/openssh-6.6p1/sshd_config.5
|
|
||||||
--- a/openssh-6.6p1/sshd_config.5
|
|
||||||
+++ b/openssh-6.6p1/sshd_config.5
|
|
||||||
@@ -324,16 +324,27 @@ For file transfer sessions using
|
|
||||||
no additional configuration of the environment is necessary if the
|
|
||||||
in-process sftp server is used,
|
|
||||||
though sessions which use logging do require
|
|
||||||
.Pa /dev/log
|
|
||||||
inside the chroot directory (see
|
|
||||||
.Xr sftp-server 8
|
|
||||||
for details).
|
|
||||||
.Pp
|
|
||||||
+In the special case when only sftp is used, not ssh nor scp,
|
|
||||||
+it is possible to use
|
|
||||||
+.Cm ChrootDirectory
|
|
||||||
+%h or
|
|
||||||
+.Cm ChrootDirectory
|
|
||||||
+/some/path/%u. The file system containing this directory must be
|
|
||||||
+mounted with options nodev and either nosuid or noexec. The owner of the
|
|
||||||
+directory should be the user. The ownership of the other components of the path
|
|
||||||
+must fulfill the usual conditions. No aditional files are required to be present
|
|
||||||
+in the directory.
|
|
||||||
+.Pp
|
|
||||||
The default is not to
|
|
||||||
.Xr chroot 2 .
|
|
||||||
.It Cm Ciphers
|
|
||||||
Specifies the ciphers allowed for protocol version 2.
|
|
||||||
Multiple ciphers must be comma-separated.
|
|
||||||
The supported ciphers are:
|
|
||||||
.Pp
|
|
||||||
.Dq 3des-cbc ,
|
|
@ -1,3 +0,0 @@
|
|||||||
version https://git-lfs.github.com/spec/v1
|
|
||||||
oid sha256:48c1f0664b4534875038004cc4f3555b8329c2a81c1df48db5c517800de203bb
|
|
||||||
size 1282502
|
|
@ -1,14 +0,0 @@
|
|||||||
-----BEGIN PGP SIGNATURE-----
|
|
||||||
Version: GnuPG v2.0.22 (OpenBSD)
|
|
||||||
|
|
||||||
iQGlAwUAUyEVxtPl9Wttkg0wAQr39wx/SkCPbWVsEG2Do7IXKg1FudhKIt8QGQZC
|
|
||||||
4bNvnwFbFZ/RNEv+BZRKH7AmgNLXn6/VTlRkifF3osrvJ6gh8EfQMkNPB5WcRz5h
|
|
||||||
c4KdAcL6u/KFxku0x/hjqUaAV980HlUFvAmGv3/YTL8n14uRBRlrVCnG5q1LmIv7
|
|
||||||
piBnb+FrAivrNV+PUMkkrC6XKrfR2ns+ZtfgwBQGQ/VuJTQZPOUMp/GLViHBxz4l
|
|
||||||
G0H52bolzAIunzBxXF9fWwFU8JFtCEharFr7jYuLQzViUPCaf3L9w3yPb2S24wnU
|
|
||||||
772CEyGbdCJVLmtD9ObaNKk0We6hdc6Dz+mx/JbHkoWSw0LYdHFbjFR75vjNENYh
|
|
||||||
evRgqLCP91micfhZDQqX6tOLnMfBjxCjHsCYvMlDACiEvxb1Ct6Fm9m1lXIGUsh3
|
|
||||||
ssScaCvQItMAvQdjQOdCXS7Zcucfzzx3Fd8Q2X/h2R81yYv6JjYQy7aBV/DaFDzP
|
|
||||||
/BhCwnq5sP6XW6rHRZGYXhMaAEjZml8ySRFEzW+esnGf9vSJgnQ+Kw==
|
|
||||||
=H2K/
|
|
||||||
-----END PGP SIGNATURE-----
|
|
@ -1,10 +1,14 @@
|
|||||||
|
# HG changeset patch
|
||||||
|
# Parent e75958369c26f618744c229ef1a9925d8ccb1dcb
|
||||||
# enable trusted X11 forwarding by default in both sshd and sshsystem-wide
|
# enable trusted X11 forwarding by default in both sshd and sshsystem-wide
|
||||||
# configuration
|
# configuration
|
||||||
# bnc#50836 (was suse #35836)
|
# bnc#50836 (was suse #35836)
|
||||||
|
Enable Trusted X11 forwarding by default, since the security benefits of
|
||||||
|
having it disabled are negligible these days with XI2 being widely used.
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/ssh_config b/openssh-6.6p1/ssh_config
|
diff --git a/openssh-7.2p2/ssh_config b/openssh-7.2p2/ssh_config
|
||||||
--- a/openssh-6.6p1/ssh_config
|
--- a/openssh-7.2p2/ssh_config
|
||||||
+++ b/openssh-6.6p1/ssh_config
|
+++ b/openssh-7.2p2/ssh_config
|
||||||
@@ -12,19 +12,30 @@
|
@@ -12,19 +12,30 @@
|
||||||
# Any configuration value is only changed the first time it is set.
|
# Any configuration value is only changed the first time it is set.
|
||||||
# Thus, host-specific definitions should be at the beginning of the
|
# Thus, host-specific definitions should be at the beginning of the
|
||||||
@ -26,7 +30,7 @@ diff --git a/openssh-6.6p1/ssh_config b/openssh-6.6p1/ssh_config
|
|||||||
+# keystrokes as you type, just like any other X11 client could do.
|
+# keystrokes as you type, just like any other X11 client could do.
|
||||||
+# Set this to "no" here for global effect or in your own ~/.ssh/config
|
+# Set this to "no" here for global effect or in your own ~/.ssh/config
|
||||||
+# file if you want to have the remote X11 authentification data to
|
+# file if you want to have the remote X11 authentification data to
|
||||||
+# expire after two minutes after remote login.
|
+# expire after twenty minutes after remote login.
|
||||||
+ ForwardX11Trusted yes
|
+ ForwardX11Trusted yes
|
||||||
+
|
+
|
||||||
# RhostsRSAAuthentication no
|
# RhostsRSAAuthentication no
|
||||||
@ -37,9 +41,9 @@ diff --git a/openssh-6.6p1/ssh_config b/openssh-6.6p1/ssh_config
|
|||||||
# GSSAPIDelegateCredentials no
|
# GSSAPIDelegateCredentials no
|
||||||
# BatchMode no
|
# BatchMode no
|
||||||
# CheckHostIP yes
|
# CheckHostIP yes
|
||||||
diff --git a/openssh-6.6p1/sshd_config b/openssh-6.6p1/sshd_config
|
diff --git a/openssh-7.2p2/sshd_config b/openssh-7.2p2/sshd_config
|
||||||
--- a/openssh-6.6p1/sshd_config
|
--- a/openssh-7.2p2/sshd_config
|
||||||
+++ b/openssh-6.6p1/sshd_config
|
+++ b/openssh-7.2p2/sshd_config
|
||||||
@@ -94,17 +94,17 @@ AuthorizedKeysFile .ssh/authorized_keys
|
@@ -94,17 +94,17 @@ AuthorizedKeysFile .ssh/authorized_keys
|
||||||
# If you just want the PAM account and session checks to run without
|
# If you just want the PAM account and session checks to run without
|
||||||
# PAM authentication, then enable this but set PasswordAuthentication
|
# PAM authentication, then enable this but set PasswordAuthentication
|
||||||
@ -58,4 +62,4 @@ diff --git a/openssh-6.6p1/sshd_config b/openssh-6.6p1/sshd_config
|
|||||||
#PrintLastLog yes
|
#PrintLastLog yes
|
||||||
#TCPKeepAlive yes
|
#TCPKeepAlive yes
|
||||||
#UseLogin no
|
#UseLogin no
|
||||||
UsePrivilegeSeparation sandbox # Default for new installations.
|
#UsePrivilegeSeparation sandbox
|
95
openssh-7.2p2-allow_root_password_login.patch
Normal file
95
openssh-7.2p2-allow_root_password_login.patch
Normal file
@ -0,0 +1,95 @@
|
|||||||
|
# HG changeset patch
|
||||||
|
# Parent dff5e86b989543049cc51bb57e75a63c1942cda3
|
||||||
|
Allow root login with password by default. While less secure than upstream
|
||||||
|
default of forbidding access to the root account with a password, we are
|
||||||
|
temporarily introducing this change to keep the default used in older OpenSSH
|
||||||
|
versions shipped with SLE.
|
||||||
|
|
||||||
|
diff --git a/openssh-7.2p2/servconf.c b/openssh-7.2p2/servconf.c
|
||||||
|
--- a/openssh-7.2p2/servconf.c
|
||||||
|
+++ b/openssh-7.2p2/servconf.c
|
||||||
|
@@ -233,17 +233,17 @@ fill_default_server_options(ServerOption
|
||||||
|
options->pid_file = xstrdup(_PATH_SSH_DAEMON_PID_FILE);
|
||||||
|
if (options->server_key_bits == -1)
|
||||||
|
options->server_key_bits = 1024;
|
||||||
|
if (options->login_grace_time == -1)
|
||||||
|
options->login_grace_time = 120;
|
||||||
|
if (options->key_regeneration_time == -1)
|
||||||
|
options->key_regeneration_time = 3600;
|
||||||
|
if (options->permit_root_login == PERMIT_NOT_SET)
|
||||||
|
- options->permit_root_login = PERMIT_NO_PASSWD;
|
||||||
|
+ options->permit_root_login = PERMIT_YES;
|
||||||
|
if (options->ignore_rhosts == -1)
|
||||||
|
options->ignore_rhosts = 1;
|
||||||
|
if (options->ignore_user_known_hosts == -1)
|
||||||
|
options->ignore_user_known_hosts = 0;
|
||||||
|
if (options->print_motd == -1)
|
||||||
|
options->print_motd = 1;
|
||||||
|
if (options->print_lastlog == -1)
|
||||||
|
options->print_lastlog = 1;
|
||||||
|
diff --git a/openssh-7.2p2/sshd_config b/openssh-7.2p2/sshd_config
|
||||||
|
--- a/openssh-7.2p2/sshd_config
|
||||||
|
+++ b/openssh-7.2p2/sshd_config
|
||||||
|
@@ -36,17 +36,17 @@
|
||||||
|
# Logging
|
||||||
|
# obsoletes QuietMode and FascistLogging
|
||||||
|
#SyslogFacility AUTH
|
||||||
|
#LogLevel INFO
|
||||||
|
|
||||||
|
# Authentication:
|
||||||
|
|
||||||
|
#LoginGraceTime 2m
|
||||||
|
-#PermitRootLogin prohibit-password
|
||||||
|
+#PermitRootLogin yes
|
||||||
|
#StrictModes yes
|
||||||
|
#MaxAuthTries 6
|
||||||
|
#MaxSessions 10
|
||||||
|
|
||||||
|
#RSAAuthentication yes
|
||||||
|
#PubkeyAuthentication yes
|
||||||
|
|
||||||
|
# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
|
||||||
|
diff --git a/openssh-7.2p2/sshd_config.0 b/openssh-7.2p2/sshd_config.0
|
||||||
|
--- a/openssh-7.2p2/sshd_config.0
|
||||||
|
+++ b/openssh-7.2p2/sshd_config.0
|
||||||
|
@@ -710,17 +710,17 @@ DESCRIPTION
|
||||||
|
restrictions and permit any forwarding requests. An argument of
|
||||||
|
M-bM-^@M-^\noneM-bM-^@M-^] can be used to prohibit all forwarding requests. By
|
||||||
|
default all port forwarding requests are permitted.
|
||||||
|
|
||||||
|
PermitRootLogin
|
||||||
|
Specifies whether root can log in using ssh(1). The argument
|
||||||
|
must be M-bM-^@M-^\yesM-bM-^@M-^], M-bM-^@M-^\prohibit-passwordM-bM-^@M-^], M-bM-^@M-^\without-passwordM-bM-^@M-^],
|
||||||
|
M-bM-^@M-^\forced-commands-onlyM-bM-^@M-^], or M-bM-^@M-^\noM-bM-^@M-^]. The default is
|
||||||
|
- M-bM-^@M-^\prohibit-passwordM-bM-^@M-^].
|
||||||
|
+ M-bM-^@M-^\yesM-bM-^@M-^].
|
||||||
|
|
||||||
|
If this option is set to M-bM-^@M-^\prohibit-passwordM-bM-^@M-^] or
|
||||||
|
M-bM-^@M-^\without-passwordM-bM-^@M-^], password and keyboard-interactive
|
||||||
|
authentication are disabled for root.
|
||||||
|
|
||||||
|
If this option is set to M-bM-^@M-^\forced-commands-onlyM-bM-^@M-^], root login with
|
||||||
|
public key authentication will be allowed, but only if the
|
||||||
|
command option has been specified (which may be useful for taking
|
||||||
|
diff --git a/openssh-7.2p2/sshd_config.5 b/openssh-7.2p2/sshd_config.5
|
||||||
|
--- a/openssh-7.2p2/sshd_config.5
|
||||||
|
+++ b/openssh-7.2p2/sshd_config.5
|
||||||
|
@@ -1213,17 +1213,17 @@ Specifies whether root can log in using
|
||||||
|
The argument must be
|
||||||
|
.Dq yes ,
|
||||||
|
.Dq prohibit-password ,
|
||||||
|
.Dq without-password ,
|
||||||
|
.Dq forced-commands-only ,
|
||||||
|
or
|
||||||
|
.Dq no .
|
||||||
|
The default is
|
||||||
|
-.Dq prohibit-password .
|
||||||
|
+.Dq yes .
|
||||||
|
.Pp
|
||||||
|
If this option is set to
|
||||||
|
.Dq prohibit-password
|
||||||
|
or
|
||||||
|
.Dq without-password ,
|
||||||
|
password and keyboard-interactive authentication are disabled for root.
|
||||||
|
.Pp
|
||||||
|
If this option is set to
|
@ -1,18 +1,21 @@
|
|||||||
# block SIGALRM while logging through syslog to prevent deadlocks (through
|
# HG changeset patch
|
||||||
# grace_alarm_handler)
|
# Parent a80e23747c8fbba7302c5a7ccb6b206d96093e42
|
||||||
# bnc#57354
|
block SIGALRM while logging through syslog to prevent deadlocks
|
||||||
|
(through grace_alarm_handler())
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/log.c b/openssh-6.6p1/log.c
|
bnc#57354
|
||||||
--- a/openssh-6.6p1/log.c
|
|
||||||
+++ b/openssh-6.6p1/log.c
|
diff --git a/openssh-7.2p2/log.c b/openssh-7.2p2/log.c
|
||||||
@@ -47,16 +47,17 @@
|
--- a/openssh-7.2p2/log.c
|
||||||
|
+++ b/openssh-7.2p2/log.c
|
||||||
|
@@ -46,16 +46,17 @@
|
||||||
|
#include <syslog.h>
|
||||||
#include <unistd.h>
|
#include <unistd.h>
|
||||||
#include <errno.h>
|
#include <errno.h>
|
||||||
#if defined(HAVE_STRNVIS) && defined(HAVE_VIS_H) && !defined(BROKEN_STRNVIS)
|
#if defined(HAVE_STRNVIS) && defined(HAVE_VIS_H) && !defined(BROKEN_STRNVIS)
|
||||||
# include <vis.h>
|
# include <vis.h>
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
#include "xmalloc.h"
|
|
||||||
#include "log.h"
|
#include "log.h"
|
||||||
+#include <signal.h>
|
+#include <signal.h>
|
||||||
|
|
||||||
@ -23,7 +26,7 @@ diff --git a/openssh-6.6p1/log.c b/openssh-6.6p1/log.c
|
|||||||
static char *argv0;
|
static char *argv0;
|
||||||
static log_handler_fn *log_handler;
|
static log_handler_fn *log_handler;
|
||||||
static void *log_handler_ctx;
|
static void *log_handler_ctx;
|
||||||
@@ -384,16 +385,17 @@ do_log(LogLevel level, const char *fmt,
|
@@ -383,16 +384,17 @@ do_log(LogLevel level, const char *fmt,
|
||||||
{
|
{
|
||||||
#if defined(HAVE_OPENLOG_R) && defined(SYSLOG_DATA_INIT)
|
#if defined(HAVE_OPENLOG_R) && defined(SYSLOG_DATA_INIT)
|
||||||
struct syslog_data sdata = SYSLOG_DATA_INIT;
|
struct syslog_data sdata = SYSLOG_DATA_INIT;
|
||||||
@ -41,7 +44,7 @@ diff --git a/openssh-6.6p1/log.c b/openssh-6.6p1/log.c
|
|||||||
|
|
||||||
switch (level) {
|
switch (level) {
|
||||||
case SYSLOG_LEVEL_FATAL:
|
case SYSLOG_LEVEL_FATAL:
|
||||||
@@ -442,20 +444,29 @@ do_log(LogLevel level, const char *fmt,
|
@@ -441,20 +443,29 @@ do_log(LogLevel level, const char *fmt,
|
||||||
tmp_handler = log_handler;
|
tmp_handler = log_handler;
|
||||||
log_handler = NULL;
|
log_handler = NULL;
|
||||||
tmp_handler(level, fmtbuf, log_handler_ctx);
|
tmp_handler(level, fmtbuf, log_handler_ctx);
|
345
openssh-7.2p2-disable_short_DH_parameters.patch
Normal file
345
openssh-7.2p2-disable_short_DH_parameters.patch
Normal file
@ -0,0 +1,345 @@
|
|||||||
|
# HG changeset patch
|
||||||
|
# Parent 7e46491ef372d47617499c58acf2ea66216858d2
|
||||||
|
|
||||||
|
Raise minimal size of DH group parameters to 2048 bits like upstream did in
|
||||||
|
7.2. 1024b values are believed to be in breaking range for state adversaries
|
||||||
|
and the default moduli shipped with openssh have been around long enough to
|
||||||
|
make it more likely for them to be broken.
|
||||||
|
|
||||||
|
Also provide an option that allows the client to accept shorter (RFC4419
|
||||||
|
compliant) parameters.
|
||||||
|
|
||||||
|
CVE-2015-4000 (LOGJAM)
|
||||||
|
bsc#932483
|
||||||
|
|
||||||
|
diff --git a/openssh-7.2p2/dh.c b/openssh-7.2p2/dh.c
|
||||||
|
--- a/openssh-7.2p2/dh.c
|
||||||
|
+++ b/openssh-7.2p2/dh.c
|
||||||
|
@@ -37,16 +37,18 @@
|
||||||
|
#include <limits.h>
|
||||||
|
|
||||||
|
#include "dh.h"
|
||||||
|
#include "pathnames.h"
|
||||||
|
#include "log.h"
|
||||||
|
#include "misc.h"
|
||||||
|
#include "ssherr.h"
|
||||||
|
|
||||||
|
+int dh_grp_min = DH_GRP_MIN;
|
||||||
|
+
|
||||||
|
static int
|
||||||
|
parse_prime(int linenum, char *line, struct dhgroup *dhg)
|
||||||
|
{
|
||||||
|
char *cp, *arg;
|
||||||
|
char *strsize, *gen, *prime;
|
||||||
|
const char *errstr = NULL;
|
||||||
|
long long n;
|
||||||
|
|
||||||
|
diff --git a/openssh-7.2p2/dh.h b/openssh-7.2p2/dh.h
|
||||||
|
--- a/openssh-7.2p2/dh.h
|
||||||
|
+++ b/openssh-7.2p2/dh.h
|
||||||
|
@@ -43,16 +43,17 @@ int dh_gen_key(DH *, int);
|
||||||
|
int dh_pub_is_valid(DH *, BIGNUM *);
|
||||||
|
|
||||||
|
u_int dh_estimate(int);
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Max value from RFC4419.
|
||||||
|
* Miniumum increased in light of DH precomputation attacks.
|
||||||
|
*/
|
||||||
|
+#define DH_GRP_MIN_RFC 1024
|
||||||
|
#define DH_GRP_MIN 2048
|
||||||
|
#define DH_GRP_MAX 8192
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Values for "type" field of moduli(5)
|
||||||
|
* Specifies the internal structure of the prime modulus.
|
||||||
|
*/
|
||||||
|
#define MODULI_TYPE_UNKNOWN (0)
|
||||||
|
diff --git a/openssh-7.2p2/kexgexc.c b/openssh-7.2p2/kexgexc.c
|
||||||
|
--- a/openssh-7.2p2/kexgexc.c
|
||||||
|
+++ b/openssh-7.2p2/kexgexc.c
|
||||||
|
@@ -46,29 +46,32 @@
|
||||||
|
#include "packet.h"
|
||||||
|
#include "dh.h"
|
||||||
|
#include "ssh2.h"
|
||||||
|
#include "compat.h"
|
||||||
|
#include "dispatch.h"
|
||||||
|
#include "ssherr.h"
|
||||||
|
#include "sshbuf.h"
|
||||||
|
|
||||||
|
+/* import from dh.c */
|
||||||
|
+extern int dh_grp_min;
|
||||||
|
+
|
||||||
|
static int input_kex_dh_gex_group(int, u_int32_t, void *);
|
||||||
|
static int input_kex_dh_gex_reply(int, u_int32_t, void *);
|
||||||
|
|
||||||
|
int
|
||||||
|
kexgex_client(struct ssh *ssh)
|
||||||
|
{
|
||||||
|
struct kex *kex = ssh->kex;
|
||||||
|
int r;
|
||||||
|
u_int nbits;
|
||||||
|
|
||||||
|
nbits = dh_estimate(kex->dh_need * 8);
|
||||||
|
|
||||||
|
- kex->min = DH_GRP_MIN;
|
||||||
|
+ kex->min = dh_grp_min;
|
||||||
|
kex->max = DH_GRP_MAX;
|
||||||
|
kex->nbits = nbits;
|
||||||
|
if (datafellows & SSH_BUG_DHGEX_LARGE)
|
||||||
|
kex->nbits = MIN(kex->nbits, 4096);
|
||||||
|
/* New GEX request */
|
||||||
|
if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_DH_GEX_REQUEST)) != 0 ||
|
||||||
|
(r = sshpkt_put_u32(ssh, kex->min)) != 0 ||
|
||||||
|
(r = sshpkt_put_u32(ssh, kex->nbits)) != 0 ||
|
||||||
|
@@ -104,16 +107,22 @@ input_kex_dh_gex_group(int type, u_int32
|
||||||
|
goto out;
|
||||||
|
}
|
||||||
|
if ((r = sshpkt_get_bignum2(ssh, p)) != 0 ||
|
||||||
|
(r = sshpkt_get_bignum2(ssh, g)) != 0 ||
|
||||||
|
(r = sshpkt_get_end(ssh)) != 0)
|
||||||
|
goto out;
|
||||||
|
if ((bits = BN_num_bits(p)) < 0 ||
|
||||||
|
(u_int)bits < kex->min || (u_int)bits > kex->max) {
|
||||||
|
+ if (bits < kex->min && bits >= DH_GRP_MIN_RFC)
|
||||||
|
+ logit("DH parameter offered by the server (%d bits) "
|
||||||
|
+ "is considered insecure. "
|
||||||
|
+ "You can lower the accepted the minimum "
|
||||||
|
+ "via the KexDHMin option.",
|
||||||
|
+ bits);
|
||||||
|
r = SSH_ERR_DH_GEX_OUT_OF_RANGE;
|
||||||
|
goto out;
|
||||||
|
}
|
||||||
|
if ((kex->dh = dh_new_group(g, p)) == NULL) {
|
||||||
|
r = SSH_ERR_ALLOC_FAIL;
|
||||||
|
goto out;
|
||||||
|
}
|
||||||
|
p = g = NULL; /* belong to kex->dh now */
|
||||||
|
diff --git a/openssh-7.2p2/readconf.c b/openssh-7.2p2/readconf.c
|
||||||
|
--- a/openssh-7.2p2/readconf.c
|
||||||
|
+++ b/openssh-7.2p2/readconf.c
|
||||||
|
@@ -56,16 +56,17 @@
|
||||||
|
#include "misc.h"
|
||||||
|
#include "readconf.h"
|
||||||
|
#include "match.h"
|
||||||
|
#include "kex.h"
|
||||||
|
#include "mac.h"
|
||||||
|
#include "uidswap.h"
|
||||||
|
#include "myproposal.h"
|
||||||
|
#include "digest.h"
|
||||||
|
+#include "dh.h"
|
||||||
|
|
||||||
|
/* Format of the configuration file:
|
||||||
|
|
||||||
|
# Configuration data is parsed as follows:
|
||||||
|
# 1. command line options
|
||||||
|
# 2. user-specific file
|
||||||
|
# 3. system-wide file
|
||||||
|
# Any configuration value is only changed the first time it is set.
|
||||||
|
@@ -148,17 +149,18 @@ typedef enum {
|
||||||
|
oClearAllForwardings, oNoHostAuthenticationForLocalhost,
|
||||||
|
oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
|
||||||
|
oAddressFamily, oGssAuthentication, oGssDelegateCreds,
|
||||||
|
oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
|
||||||
|
oSendEnv, oControlPath, oControlMaster, oControlPersist,
|
||||||
|
oHashKnownHosts,
|
||||||
|
oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand,
|
||||||
|
oVisualHostKey,
|
||||||
|
- oKexAlgorithms, oIPQoS, oRequestTTY, oIgnoreUnknown, oProxyUseFdpass,
|
||||||
|
+ oKexAlgorithms, oKexDHMin,
|
||||||
|
+ oIPQoS, oRequestTTY, oIgnoreUnknown, oProxyUseFdpass,
|
||||||
|
oCanonicalDomains, oCanonicalizeHostname, oCanonicalizeMaxDots,
|
||||||
|
oCanonicalizeFallbackLocal, oCanonicalizePermittedCNAMEs,
|
||||||
|
oStreamLocalBindMask, oStreamLocalBindUnlink, oRevokedHostKeys,
|
||||||
|
oFingerprintHash, oUpdateHostkeys, oHostbasedKeyTypes,
|
||||||
|
oPubkeyAcceptedKeyTypes,
|
||||||
|
oIgnoredUnknownOption, oDeprecated, oUnsupported
|
||||||
|
} OpCodes;
|
||||||
|
|
||||||
|
@@ -260,16 +262,17 @@ static struct {
|
||||||
|
{ "hashknownhosts", oHashKnownHosts },
|
||||||
|
{ "tunnel", oTunnel },
|
||||||
|
{ "tunneldevice", oTunnelDevice },
|
||||||
|
{ "localcommand", oLocalCommand },
|
||||||
|
{ "permitlocalcommand", oPermitLocalCommand },
|
||||||
|
{ "visualhostkey", oVisualHostKey },
|
||||||
|
{ "useroaming", oDeprecated },
|
||||||
|
{ "kexalgorithms", oKexAlgorithms },
|
||||||
|
+ { "kexdhmin", oKexDHMin },
|
||||||
|
{ "ipqos", oIPQoS },
|
||||||
|
{ "requesttty", oRequestTTY },
|
||||||
|
{ "proxyusefdpass", oProxyUseFdpass },
|
||||||
|
{ "canonicaldomains", oCanonicalDomains },
|
||||||
|
{ "canonicalizefallbacklocal", oCanonicalizeFallbackLocal },
|
||||||
|
{ "canonicalizehostname", oCanonicalizeHostname },
|
||||||
|
{ "canonicalizemaxdots", oCanonicalizeMaxDots },
|
||||||
|
{ "canonicalizepermittedcnames", oCanonicalizePermittedCNAMEs },
|
||||||
|
@@ -280,16 +283,19 @@ static struct {
|
||||||
|
{ "updatehostkeys", oUpdateHostkeys },
|
||||||
|
{ "hostbasedkeytypes", oHostbasedKeyTypes },
|
||||||
|
{ "pubkeyacceptedkeytypes", oPubkeyAcceptedKeyTypes },
|
||||||
|
{ "ignoreunknown", oIgnoreUnknown },
|
||||||
|
|
||||||
|
{ NULL, oBadOption }
|
||||||
|
};
|
||||||
|
|
||||||
|
+/* import from dh.c */
|
||||||
|
+extern int dh_grp_min;
|
||||||
|
+
|
||||||
|
/*
|
||||||
|
* Adds a local TCP/IP port forward to options. Never returns if there is an
|
||||||
|
* error.
|
||||||
|
*/
|
||||||
|
|
||||||
|
void
|
||||||
|
add_local_forward(Options *options, const struct Forward *newfwd)
|
||||||
|
{
|
||||||
|
@@ -1157,16 +1163,20 @@ parse_int:
|
||||||
|
filename, linenum);
|
||||||
|
if (!kex_names_valid(*arg == '+' ? arg + 1 : arg))
|
||||||
|
fatal("%.200s line %d: Bad SSH2 KexAlgorithms '%s'.",
|
||||||
|
filename, linenum, arg ? arg : "<NONE>");
|
||||||
|
if (*activep && options->kex_algorithms == NULL)
|
||||||
|
options->kex_algorithms = xstrdup(arg);
|
||||||
|
break;
|
||||||
|
|
||||||
|
+ case oKexDHMin:
|
||||||
|
+ intptr = &options->kex_dhmin;
|
||||||
|
+ goto parse_int;
|
||||||
|
+
|
||||||
|
case oHostKeyAlgorithms:
|
||||||
|
charptr = &options->hostkeyalgorithms;
|
||||||
|
parse_keytypes:
|
||||||
|
arg = strdelim(&s);
|
||||||
|
if (!arg || *arg == '\0')
|
||||||
|
fatal("%.200s line %d: Missing argument.",
|
||||||
|
filename, linenum);
|
||||||
|
if (!sshkey_names_valid2(*arg == '+' ? arg + 1 : arg, 1))
|
||||||
|
@@ -1664,16 +1674,17 @@ initialize_options(Options * options)
|
||||||
|
options->address_family = -1;
|
||||||
|
options->connection_attempts = -1;
|
||||||
|
options->connection_timeout = -1;
|
||||||
|
options->number_of_password_prompts = -1;
|
||||||
|
options->cipher = -1;
|
||||||
|
options->ciphers = NULL;
|
||||||
|
options->macs = NULL;
|
||||||
|
options->kex_algorithms = NULL;
|
||||||
|
+ options->kex_dhmin = -1;
|
||||||
|
options->hostkeyalgorithms = NULL;
|
||||||
|
options->protocol = SSH_PROTO_UNKNOWN;
|
||||||
|
options->num_identity_files = 0;
|
||||||
|
options->num_certificate_files = 0;
|
||||||
|
options->hostname = NULL;
|
||||||
|
options->host_key_alias = NULL;
|
||||||
|
options->proxy_command = NULL;
|
||||||
|
options->user = NULL;
|
||||||
|
@@ -1805,16 +1816,23 @@ fill_default_options(Options * options)
|
||||||
|
options->address_family = AF_UNSPEC;
|
||||||
|
if (options->connection_attempts == -1)
|
||||||
|
options->connection_attempts = 1;
|
||||||
|
if (options->number_of_password_prompts == -1)
|
||||||
|
options->number_of_password_prompts = 3;
|
||||||
|
/* Selected in ssh_login(). */
|
||||||
|
if (options->cipher == -1)
|
||||||
|
options->cipher = SSH_CIPHER_NOT_SET;
|
||||||
|
+ if (options->kex_dhmin == -1)
|
||||||
|
+ options->kex_dhmin = DH_GRP_MIN;
|
||||||
|
+ else {
|
||||||
|
+ options->kex_dhmin = MAX(options->kex_dhmin, DH_GRP_MIN_RFC);
|
||||||
|
+ options->kex_dhmin = MIN(options->kex_dhmin, DH_GRP_MAX);
|
||||||
|
+ }
|
||||||
|
+ dh_grp_min = options->kex_dhmin;
|
||||||
|
/* options->hostkeyalgorithms, default set in myproposals.h */
|
||||||
|
if (options->protocol == SSH_PROTO_UNKNOWN)
|
||||||
|
options->protocol = SSH_PROTO_2;
|
||||||
|
if (options->add_keys_to_agent == -1)
|
||||||
|
options->add_keys_to_agent = 0;
|
||||||
|
if (options->num_identity_files == 0) {
|
||||||
|
if (options->protocol & SSH_PROTO_1) {
|
||||||
|
add_identity_file(options, "~/",
|
||||||
|
diff --git a/openssh-7.2p2/readconf.h b/openssh-7.2p2/readconf.h
|
||||||
|
--- a/openssh-7.2p2/readconf.h
|
||||||
|
+++ b/openssh-7.2p2/readconf.h
|
||||||
|
@@ -69,16 +69,17 @@ typedef struct {
|
||||||
|
* aborting connection attempt */
|
||||||
|
int number_of_password_prompts; /* Max number of password
|
||||||
|
* prompts. */
|
||||||
|
int cipher; /* Cipher to use. */
|
||||||
|
char *ciphers; /* SSH2 ciphers in order of preference. */
|
||||||
|
char *macs; /* SSH2 macs in order of preference. */
|
||||||
|
char *hostkeyalgorithms; /* SSH2 server key types in order of preference. */
|
||||||
|
char *kex_algorithms; /* SSH2 kex methods in order of preference. */
|
||||||
|
+ int kex_dhmin; /* minimum bit length of the DH group parameter */
|
||||||
|
int protocol; /* Protocol in order of preference. */
|
||||||
|
char *hostname; /* Real host to connect. */
|
||||||
|
char *host_key_alias; /* hostname alias for .ssh/known_hosts */
|
||||||
|
char *proxy_command; /* Proxy command for connecting the host. */
|
||||||
|
char *user; /* User to log in as. */
|
||||||
|
int escape_char; /* Escape character; -2 = none */
|
||||||
|
|
||||||
|
u_int num_system_hostfiles; /* Paths for /etc/ssh/ssh_known_hosts */
|
||||||
|
diff --git a/openssh-7.2p2/ssh_config.0 b/openssh-7.2p2/ssh_config.0
|
||||||
|
--- a/openssh-7.2p2/ssh_config.0
|
||||||
|
+++ b/openssh-7.2p2/ssh_config.0
|
||||||
|
@@ -606,16 +606,29 @@ DESCRIPTION
|
||||||
|
ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
|
||||||
|
diffie-hellman-group-exchange-sha256,
|
||||||
|
diffie-hellman-group-exchange-sha1,
|
||||||
|
diffie-hellman-group14-sha1
|
||||||
|
|
||||||
|
The list of available key exchange algorithms may also be
|
||||||
|
obtained using the -Q option of ssh(1) with an argument of M-bM-^@M-^\kexM-bM-^@M-^].
|
||||||
|
|
||||||
|
+ KexDHMin
|
||||||
|
+ Specifies the minimum accepted bit length of the DH group parameter p.
|
||||||
|
+ As per RFC4419, this is 1024 bits however, this has increasingly
|
||||||
|
+ been seen as insecure, which prompted the change to 2048 bits.
|
||||||
|
+ Setting this option allows the client to accept parameters shorter
|
||||||
|
+ than the current minimum, down to the RFC specified 1024 bits.
|
||||||
|
+ Using this option may be needed when connecting to servers that
|
||||||
|
+ only know short DH group parameters.
|
||||||
|
+
|
||||||
|
+ Note that using this option can severly impact security and thus
|
||||||
|
+ should be viewed as a temporary fix of last resort and all efforts
|
||||||
|
+ should be made to fix the server.
|
||||||
|
+
|
||||||
|
LocalCommand
|
||||||
|
Specifies a command to execute on the local machine after
|
||||||
|
successfully connecting to the server. The command string
|
||||||
|
extends to the end of the line, and is executed with the user's
|
||||||
|
shell. The following escape character substitutions will be
|
||||||
|
performed: M-bM-^@M-^X%dM-bM-^@M-^Y (local user's home directory), M-bM-^@M-^X%hM-bM-^@M-^Y (remote host
|
||||||
|
name), M-bM-^@M-^X%lM-bM-^@M-^Y (local host name), M-bM-^@M-^X%nM-bM-^@M-^Y (host name as provided on the
|
||||||
|
command line), M-bM-^@M-^X%pM-bM-^@M-^Y (remote port), M-bM-^@M-^X%rM-bM-^@M-^Y (remote user name) or
|
||||||
|
diff --git a/openssh-7.2p2/ssh_config.5 b/openssh-7.2p2/ssh_config.5
|
||||||
|
--- a/openssh-7.2p2/ssh_config.5
|
||||||
|
+++ b/openssh-7.2p2/ssh_config.5
|
||||||
|
@@ -1092,16 +1092,28 @@ diffie-hellman-group14-sha1
|
||||||
|
.Ed
|
||||||
|
.Pp
|
||||||
|
The list of available key exchange algorithms may also be obtained using the
|
||||||
|
.Fl Q
|
||||||
|
option of
|
||||||
|
.Xr ssh 1
|
||||||
|
with an argument of
|
||||||
|
.Dq kex .
|
||||||
|
+.It Cm KexDHMin
|
||||||
|
+Specifies the minimum accepted bit length of the DH group parameter p.
|
||||||
|
+As per RFC4419, this is 1024 bits however, this has increasingly
|
||||||
|
+been seen as insecure, which prompted the change to 2048 bits.
|
||||||
|
+Setting this option allows the client to accept parameters shorter
|
||||||
|
+than the current minimum, down to the RFC specified 1024 bits.
|
||||||
|
+Using this option may be needed when connecting to servers that
|
||||||
|
+only know short DH group parameters.
|
||||||
|
+
|
||||||
|
+Note that using this option can severly impact security and thus
|
||||||
|
+should be viewed as a temporary fix of last resort and all efforts
|
||||||
|
+should be made to fix the server.
|
||||||
|
.It Cm LocalCommand
|
||||||
|
Specifies a command to execute on the local machine after successfully
|
||||||
|
connecting to the server.
|
||||||
|
The command string extends to the end of the line, and is executed with
|
||||||
|
the user's shell.
|
||||||
|
The following escape character substitutions will be performed:
|
||||||
|
.Ql %d
|
||||||
|
(local user's home directory),
|
@ -1,10 +1,12 @@
|
|||||||
|
# HG changeset patch
|
||||||
|
# Parent 779a907d59d4907d10a8f0b3f52a38d8bdf115b6
|
||||||
# posix threads are generally not supported nor safe
|
# posix threads are generally not supported nor safe
|
||||||
# (see upstream log from 2005-05-24)
|
# (see upstream log from 2005-05-24)
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/auth-pam.c b/openssh-6.6p1/auth-pam.c
|
diff --git a/openssh-7.2p2/auth-pam.c b/openssh-7.2p2/auth-pam.c
|
||||||
--- a/openssh-6.6p1/auth-pam.c
|
--- a/openssh-7.2p2/auth-pam.c
|
||||||
+++ b/openssh-6.6p1/auth-pam.c
|
+++ b/openssh-7.2p2/auth-pam.c
|
||||||
@@ -781,17 +781,19 @@ sshpam_query(void *ctx, char **name, cha
|
@@ -782,17 +782,19 @@ sshpam_query(void *ctx, char **name, cha
|
||||||
}
|
}
|
||||||
if (type == PAM_SUCCESS) {
|
if (type == PAM_SUCCESS) {
|
||||||
if (!sshpam_authctxt->valid ||
|
if (!sshpam_authctxt->valid ||
|
@ -1,9 +1,11 @@
|
|||||||
# fix paths and references in sshd man pages
|
# HG changeset patch
|
||||||
|
# Parent 8a9b47df710e3a0bbea4af0f9274bb175944a8a9
|
||||||
|
fix paths and references in sshd man pages
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/sshd.8 b/openssh-6.6p1/sshd.8
|
diff --git a/openssh-7.2p2/sshd.8 b/openssh-7.2p2/sshd.8
|
||||||
--- a/openssh-6.6p1/sshd.8
|
--- a/openssh-7.2p2/sshd.8
|
||||||
+++ b/openssh-6.6p1/sshd.8
|
+++ b/openssh-7.2p2/sshd.8
|
||||||
@@ -875,17 +875,17 @@ See
|
@@ -901,17 +901,17 @@ See
|
||||||
If this file exists,
|
If this file exists,
|
||||||
.Nm
|
.Nm
|
||||||
refuses to let anyone except root log in.
|
refuses to let anyone except root log in.
|
||||||
@ -22,7 +24,8 @@ diff --git a/openssh-6.6p1/sshd.8 b/openssh-6.6p1/sshd.8
|
|||||||
.It Pa /etc/ssh/ssh_host_key
|
.It Pa /etc/ssh/ssh_host_key
|
||||||
.It Pa /etc/ssh/ssh_host_dsa_key
|
.It Pa /etc/ssh/ssh_host_dsa_key
|
||||||
.It Pa /etc/ssh/ssh_host_ecdsa_key
|
.It Pa /etc/ssh/ssh_host_ecdsa_key
|
||||||
@@ -956,17 +956,17 @@ The content of this file is not sensitiv
|
@@ -981,17 +981,17 @@ The content of this file is not sensitiv
|
||||||
|
.Xr scp 1 ,
|
||||||
.Xr sftp 1 ,
|
.Xr sftp 1 ,
|
||||||
.Xr ssh 1 ,
|
.Xr ssh 1 ,
|
||||||
.Xr ssh-add 1 ,
|
.Xr ssh-add 1 ,
|
||||||
@ -30,7 +33,6 @@ diff --git a/openssh-6.6p1/sshd.8 b/openssh-6.6p1/sshd.8
|
|||||||
.Xr ssh-keygen 1 ,
|
.Xr ssh-keygen 1 ,
|
||||||
.Xr ssh-keyscan 1 ,
|
.Xr ssh-keyscan 1 ,
|
||||||
.Xr chroot 2 ,
|
.Xr chroot 2 ,
|
||||||
.Xr hosts_access 5 ,
|
|
||||||
-.Xr login.conf 5 ,
|
-.Xr login.conf 5 ,
|
||||||
+.Xr login.defs 5 ,
|
+.Xr login.defs 5 ,
|
||||||
.Xr moduli 5 ,
|
.Xr moduli 5 ,
|
||||||
@ -41,19 +43,19 @@ diff --git a/openssh-6.6p1/sshd.8 b/openssh-6.6p1/sshd.8
|
|||||||
OpenSSH is a derivative of the original and free
|
OpenSSH is a derivative of the original and free
|
||||||
ssh 1.2.12 release by Tatu Ylonen.
|
ssh 1.2.12 release by Tatu Ylonen.
|
||||||
Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos,
|
Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos,
|
||||||
diff --git a/openssh-6.6p1/sshd_config.5 b/openssh-6.6p1/sshd_config.5
|
diff --git a/openssh-7.2p2/sshd_config.5 b/openssh-7.2p2/sshd_config.5
|
||||||
--- a/openssh-6.6p1/sshd_config.5
|
--- a/openssh-7.2p2/sshd_config.5
|
||||||
+++ b/openssh-6.6p1/sshd_config.5
|
+++ b/openssh-7.2p2/sshd_config.5
|
||||||
@@ -278,18 +278,17 @@ The contents of the specified file are s
|
@@ -370,18 +370,17 @@ for details).
|
||||||
|
The contents of the specified file are sent to the remote user before
|
||||||
authentication is allowed.
|
authentication is allowed.
|
||||||
If the argument is
|
If the argument is
|
||||||
.Dq none
|
.Dq none
|
||||||
then no banner is displayed.
|
then no banner is displayed.
|
||||||
This option is only available for protocol version 2.
|
|
||||||
By default, no banner is displayed.
|
By default, no banner is displayed.
|
||||||
.It Cm ChallengeResponseAuthentication
|
.It Cm ChallengeResponseAuthentication
|
||||||
Specifies whether challenge-response authentication is allowed (e.g. via
|
Specifies whether challenge-response authentication is allowed (e.g. via
|
||||||
-PAM or though authentication styles supported in
|
-PAM or through authentication styles supported in
|
||||||
-.Xr login.conf 5 )
|
-.Xr login.conf 5 )
|
||||||
+PAM)
|
+PAM)
|
||||||
The default is
|
The default is
|
||||||
@ -62,9 +64,9 @@ diff --git a/openssh-6.6p1/sshd_config.5 b/openssh-6.6p1/sshd_config.5
|
|||||||
Specifies the pathname of a directory to
|
Specifies the pathname of a directory to
|
||||||
.Xr chroot 2
|
.Xr chroot 2
|
||||||
to after authentication.
|
to after authentication.
|
||||||
All components of the pathname must be root-owned directories that are
|
At session startup
|
||||||
not writable by any other user or group.
|
.Xr sshd 8
|
||||||
@@ -576,17 +575,17 @@ and
|
@@ -766,17 +765,17 @@ and
|
||||||
.Pa .shosts
|
.Pa .shosts
|
||||||
files will not be used in
|
files will not be used in
|
||||||
.Cm RhostsRSAAuthentication
|
.Cm RhostsRSAAuthentication
|
@ -1,9 +1,11 @@
|
|||||||
|
# HG changeset patch
|
||||||
|
# Parent 40536816550c893d5ee67f90f3a917e79f73a163
|
||||||
# force PAM in defaullt install (this was removed from upstream in 3.8p1)
|
# force PAM in defaullt install (this was removed from upstream in 3.8p1)
|
||||||
# bnc#46749
|
# bnc#46749
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/sshd_config b/openssh-6.6p1/sshd_config
|
diff --git a/openssh-7.2p2/sshd_config b/openssh-7.2p2/sshd_config
|
||||||
--- a/openssh-6.6p1/sshd_config
|
--- a/openssh-7.2p2/sshd_config
|
||||||
+++ b/openssh-6.6p1/sshd_config
|
+++ b/openssh-7.2p2/sshd_config
|
||||||
@@ -64,17 +64,17 @@ AuthorizedKeysFile .ssh/authorized_keys
|
@@ -64,17 +64,17 @@ AuthorizedKeysFile .ssh/authorized_keys
|
||||||
#HostbasedAuthentication no
|
#HostbasedAuthentication no
|
||||||
# Change to yes if you don't trust ~/.ssh/known_hosts for
|
# Change to yes if you don't trust ~/.ssh/known_hosts for
|
@ -1,10 +1,13 @@
|
|||||||
# handle hostname changes when forwarding X
|
# HG changeset patch
|
||||||
# bnc#98627
|
# Parent d5e9457ee640bdd816edb9c67792cddb00c229b9
|
||||||
|
handle hostname changes when forwarding X
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/session.c b/openssh-6.6p1/session.c
|
bnc#98627
|
||||||
--- a/openssh-6.6p1/session.c
|
|
||||||
+++ b/openssh-6.6p1/session.c
|
diff --git a/openssh-7.2p2/session.c b/openssh-7.2p2/session.c
|
||||||
@@ -1146,17 +1146,17 @@ copy_environment(char **source, char ***
|
--- a/openssh-7.2p2/session.c
|
||||||
|
+++ b/openssh-7.2p2/session.c
|
||||||
|
@@ -1154,17 +1154,17 @@ copy_environment(char **source, char ***
|
||||||
debug3("Copy environment: %s=%s", var_name, var_val);
|
debug3("Copy environment: %s=%s", var_name, var_val);
|
||||||
child_set_env(env, envsize, var_name, var_val);
|
child_set_env(env, envsize, var_name, var_val);
|
||||||
|
|
||||||
@ -23,7 +26,7 @@ diff --git a/openssh-6.6p1/session.c b/openssh-6.6p1/session.c
|
|||||||
#if !defined (HAVE_LOGIN_CAP) && !defined (HAVE_CYGWIN)
|
#if !defined (HAVE_LOGIN_CAP) && !defined (HAVE_CYGWIN)
|
||||||
char *path = NULL;
|
char *path = NULL;
|
||||||
#endif
|
#endif
|
||||||
@@ -1333,25 +1333,27 @@ do_setup_env(Session *s, const char *she
|
@@ -1341,25 +1341,27 @@ do_setup_env(Session *s, const char *she
|
||||||
read_environment_file(&env, &envsize, buf);
|
read_environment_file(&env, &envsize, buf);
|
||||||
}
|
}
|
||||||
if (debug_flag) {
|
if (debug_flag) {
|
||||||
@ -52,7 +55,7 @@ diff --git a/openssh-6.6p1/session.c b/openssh-6.6p1/session.c
|
|||||||
|
|
||||||
do_xauth =
|
do_xauth =
|
||||||
s->display != NULL && s->auth_proto != NULL && s->auth_data != NULL;
|
s->display != NULL && s->auth_proto != NULL && s->auth_data != NULL;
|
||||||
@@ -1395,22 +1397,30 @@ do_rc_files(Session *s, const char *shel
|
@@ -1404,22 +1406,30 @@ do_rc_files(Session *s, const char *shel
|
||||||
"%.500s add %.100s %.100s %.100s\n",
|
"%.500s add %.100s %.100s %.100s\n",
|
||||||
options.xauth_location, s->auth_display,
|
options.xauth_location, s->auth_display,
|
||||||
s->auth_proto, s->auth_data);
|
s->auth_proto, s->auth_data);
|
||||||
@ -83,7 +86,7 @@ diff --git a/openssh-6.6p1/session.c b/openssh-6.6p1/session.c
|
|||||||
}
|
}
|
||||||
|
|
||||||
static void
|
static void
|
||||||
@@ -1664,16 +1674,17 @@ child_close_fds(void)
|
@@ -1681,16 +1691,17 @@ child_close_fds(void)
|
||||||
* ids, and executing the command or shell.
|
* ids, and executing the command or shell.
|
||||||
*/
|
*/
|
||||||
#define ARGV_MAX 10
|
#define ARGV_MAX 10
|
||||||
@ -101,7 +104,7 @@ diff --git a/openssh-6.6p1/session.c b/openssh-6.6p1/session.c
|
|||||||
/* remove hostkey from the child's memory */
|
/* remove hostkey from the child's memory */
|
||||||
destroy_sensitive_data();
|
destroy_sensitive_data();
|
||||||
|
|
||||||
@@ -1730,17 +1741,17 @@ do_child(Session *s, const char *command
|
@@ -1747,17 +1758,17 @@ do_child(Session *s, const char *command
|
||||||
* legal, and means /bin/sh.
|
* legal, and means /bin/sh.
|
||||||
*/
|
*/
|
||||||
shell = (pw->pw_shell[0] == '\0') ? _PATH_BSHELL : pw->pw_shell;
|
shell = (pw->pw_shell[0] == '\0') ? _PATH_BSHELL : pw->pw_shell;
|
||||||
@ -120,8 +123,8 @@ diff --git a/openssh-6.6p1/session.c b/openssh-6.6p1/session.c
|
|||||||
/* we have to stash the hostname before we close our socket. */
|
/* we have to stash the hostname before we close our socket. */
|
||||||
if (options.use_login)
|
if (options.use_login)
|
||||||
hostname = get_remote_name_or_ip(utmp_len,
|
hostname = get_remote_name_or_ip(utmp_len,
|
||||||
@@ -1799,17 +1810,17 @@ do_child(Session *s, const char *command
|
@@ -1816,17 +1827,17 @@ do_child(Session *s, const char *command
|
||||||
strerror(errno));
|
}
|
||||||
if (r)
|
if (r)
|
||||||
exit(1);
|
exit(1);
|
||||||
}
|
}
|
@ -1,10 +1,12 @@
|
|||||||
|
# HG changeset patch
|
||||||
|
# Parent 9b5b0f2772591aaeb0ecd4c982a9d64242ed6c8b
|
||||||
# set uid for functions that use it to seek in lastlog and wtmp files
|
# set uid for functions that use it to seek in lastlog and wtmp files
|
||||||
# bnc#18024 (was suse #3024)
|
# bnc#18024 (was suse #3024)
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/sshlogin.c b/openssh-6.6p1/sshlogin.c
|
diff --git a/openssh-7.2p2/sshlogin.c b/openssh-7.2p2/sshlogin.c
|
||||||
--- a/openssh-6.6p1/sshlogin.c
|
--- a/openssh-7.2p2/sshlogin.c
|
||||||
+++ b/openssh-6.6p1/sshlogin.c
|
+++ b/openssh-7.2p2/sshlogin.c
|
||||||
@@ -128,16 +128,17 @@ record_login(pid_t pid, const char *tty,
|
@@ -129,16 +129,17 @@ record_login(pid_t pid, const char *tty,
|
||||||
{
|
{
|
||||||
struct logininfo *li;
|
struct logininfo *li;
|
||||||
|
|
@ -1,11 +1,14 @@
|
|||||||
# new option UsePAMCheckLocks to enforce checking for locked accounts while
|
# HG changeset patch
|
||||||
# UsePAM is used
|
# Parent 9b211a1de83fa39e4b7bb36c8bd1b5fdc2bd8085
|
||||||
# bnc#708678, FATE#312033
|
new option UsePAMCheckLocks to enforce checking for locked accounts while
|
||||||
|
UsePAM is used
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/auth.c b/openssh-6.6p1/auth.c
|
bnc#708678, FATE#312033
|
||||||
--- a/openssh-6.6p1/auth.c
|
|
||||||
+++ b/openssh-6.6p1/auth.c
|
diff --git a/openssh-7.2p2/auth.c b/openssh-7.2p2/auth.c
|
||||||
@@ -103,17 +103,17 @@ allowed_user(struct passwd * pw)
|
--- a/openssh-7.2p2/auth.c
|
||||||
|
+++ b/openssh-7.2p2/auth.c
|
||||||
|
@@ -104,17 +104,17 @@ allowed_user(struct passwd * pw)
|
||||||
struct spwd *spw = NULL;
|
struct spwd *spw = NULL;
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
@ -24,7 +27,7 @@ diff --git a/openssh-6.6p1/auth.c b/openssh-6.6p1/auth.c
|
|||||||
#endif /* USE_SHADOW */
|
#endif /* USE_SHADOW */
|
||||||
|
|
||||||
/* grab passwd field for locked account check */
|
/* grab passwd field for locked account check */
|
||||||
@@ -123,17 +123,17 @@ allowed_user(struct passwd * pw)
|
@@ -124,17 +124,17 @@ allowed_user(struct passwd * pw)
|
||||||
#ifdef USE_LIBIAF
|
#ifdef USE_LIBIAF
|
||||||
passwd = get_iaf_password(pw);
|
passwd = get_iaf_password(pw);
|
||||||
#else
|
#else
|
||||||
@ -43,10 +46,10 @@ diff --git a/openssh-6.6p1/auth.c b/openssh-6.6p1/auth.c
|
|||||||
#endif
|
#endif
|
||||||
#ifdef LOCKED_PASSWD_PREFIX
|
#ifdef LOCKED_PASSWD_PREFIX
|
||||||
if (strncmp(passwd, LOCKED_PASSWD_PREFIX,
|
if (strncmp(passwd, LOCKED_PASSWD_PREFIX,
|
||||||
diff --git a/openssh-6.6p1/servconf.c b/openssh-6.6p1/servconf.c
|
diff --git a/openssh-7.2p2/servconf.c b/openssh-7.2p2/servconf.c
|
||||||
--- a/openssh-6.6p1/servconf.c
|
--- a/openssh-7.2p2/servconf.c
|
||||||
+++ b/openssh-6.6p1/servconf.c
|
+++ b/openssh-7.2p2/servconf.c
|
||||||
@@ -66,16 +66,17 @@ extern Buffer cfg;
|
@@ -69,16 +69,17 @@ extern Buffer cfg;
|
||||||
|
|
||||||
void
|
void
|
||||||
initialize_server_options(ServerOptions *options)
|
initialize_server_options(ServerOptions *options)
|
||||||
@ -60,16 +63,16 @@ diff --git a/openssh-6.6p1/servconf.c b/openssh-6.6p1/servconf.c
|
|||||||
/* Standard Options */
|
/* Standard Options */
|
||||||
options->num_ports = 0;
|
options->num_ports = 0;
|
||||||
options->ports_from_cmdline = 0;
|
options->ports_from_cmdline = 0;
|
||||||
|
options->queued_listen_addrs = NULL;
|
||||||
|
options->num_queued_listens = 0;
|
||||||
options->listen_addrs = NULL;
|
options->listen_addrs = NULL;
|
||||||
options->address_family = -1;
|
options->address_family = -1;
|
||||||
options->num_host_key_files = 0;
|
@@ -195,16 +196,18 @@ assemble_algorithms(ServerOptions *o)
|
||||||
options->num_host_cert_files = 0;
|
|
||||||
@@ -157,16 +158,18 @@ initialize_server_options(ServerOptions
|
|
||||||
}
|
|
||||||
|
|
||||||
void
|
void
|
||||||
fill_default_server_options(ServerOptions *options)
|
fill_default_server_options(ServerOptions *options)
|
||||||
{
|
{
|
||||||
|
int i;
|
||||||
|
|
||||||
/* Portable-specific options */
|
/* Portable-specific options */
|
||||||
if (options->use_pam == -1)
|
if (options->use_pam == -1)
|
||||||
options->use_pam = 0;
|
options->use_pam = 0;
|
||||||
@ -83,7 +86,7 @@ diff --git a/openssh-6.6p1/servconf.c b/openssh-6.6p1/servconf.c
|
|||||||
/* fill default hostkeys for protocols */
|
/* fill default hostkeys for protocols */
|
||||||
if (options->protocol & SSH_PROTO_1)
|
if (options->protocol & SSH_PROTO_1)
|
||||||
options->host_key_files[options->num_host_key_files++] =
|
options->host_key_files[options->num_host_key_files++] =
|
||||||
@@ -317,17 +320,17 @@ fill_default_server_options(ServerOption
|
@@ -391,17 +394,17 @@ fill_default_server_options(ServerOption
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
}
|
}
|
||||||
@ -95,14 +98,14 @@ diff --git a/openssh-6.6p1/servconf.c b/openssh-6.6p1/servconf.c
|
|||||||
- sUsePAM,
|
- sUsePAM,
|
||||||
+ sUsePAM, sUsePAMChecklocks,
|
+ sUsePAM, sUsePAMChecklocks,
|
||||||
/* Standard Options */
|
/* Standard Options */
|
||||||
sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime, sKeyRegenerationTime,
|
sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime,
|
||||||
sPermitRootLogin, sLogFacility, sLogLevel,
|
sKeyRegenerationTime, sPermitRootLogin, sLogFacility, sLogLevel,
|
||||||
sRhostsRSAAuthentication, sRSAAuthentication,
|
sRhostsRSAAuthentication, sRSAAuthentication,
|
||||||
sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
|
sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
|
||||||
sKerberosGetAFSToken,
|
sKerberosGetAFSToken,
|
||||||
sKerberosTgtPassing, sChallengeResponseAuthentication,
|
sKerberosTgtPassing, sChallengeResponseAuthentication,
|
||||||
sPasswordAuthentication, sKbdInteractiveAuthentication,
|
sPasswordAuthentication, sKbdInteractiveAuthentication,
|
||||||
@@ -362,18 +365,20 @@ typedef enum {
|
@@ -441,18 +444,20 @@ typedef enum {
|
||||||
static struct {
|
static struct {
|
||||||
const char *name;
|
const char *name;
|
||||||
ServerOpCodes opcode;
|
ServerOpCodes opcode;
|
||||||
@ -123,7 +126,7 @@ diff --git a/openssh-6.6p1/servconf.c b/openssh-6.6p1/servconf.c
|
|||||||
{ "hostdsakey", sHostKeyFile, SSHCFG_GLOBAL }, /* alias */
|
{ "hostdsakey", sHostKeyFile, SSHCFG_GLOBAL }, /* alias */
|
||||||
{ "hostkeyagent", sHostKeyAgent, SSHCFG_GLOBAL },
|
{ "hostkeyagent", sHostKeyAgent, SSHCFG_GLOBAL },
|
||||||
{ "pidfile", sPidFile, SSHCFG_GLOBAL },
|
{ "pidfile", sPidFile, SSHCFG_GLOBAL },
|
||||||
@@ -870,16 +875,19 @@ process_server_config_line(ServerOptions
|
@@ -1005,16 +1010,19 @@ process_server_config_line(ServerOptions
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -143,10 +146,10 @@ diff --git a/openssh-6.6p1/servconf.c b/openssh-6.6p1/servconf.c
|
|||||||
/* ignore ports from configfile if cmdline specifies ports */
|
/* ignore ports from configfile if cmdline specifies ports */
|
||||||
if (options->ports_from_cmdline)
|
if (options->ports_from_cmdline)
|
||||||
return 0;
|
return 0;
|
||||||
diff --git a/openssh-6.6p1/servconf.h b/openssh-6.6p1/servconf.h
|
diff --git a/openssh-7.2p2/servconf.h b/openssh-7.2p2/servconf.h
|
||||||
--- a/openssh-6.6p1/servconf.h
|
--- a/openssh-7.2p2/servconf.h
|
||||||
+++ b/openssh-6.6p1/servconf.h
|
+++ b/openssh-7.2p2/servconf.h
|
||||||
@@ -160,16 +160,17 @@ typedef struct {
|
@@ -167,16 +167,17 @@ typedef struct {
|
||||||
*/
|
*/
|
||||||
|
|
||||||
u_int num_authkeys_files; /* Files containing public keys */
|
u_int num_authkeys_files; /* Files containing public keys */
|
||||||
@ -164,17 +167,17 @@ diff --git a/openssh-6.6p1/servconf.h b/openssh-6.6p1/servconf.h
|
|||||||
char *chroot_directory;
|
char *chroot_directory;
|
||||||
char *revoked_keys_file;
|
char *revoked_keys_file;
|
||||||
char *trusted_user_ca_keys;
|
char *trusted_user_ca_keys;
|
||||||
diff --git a/openssh-6.6p1/sshd_config.0 b/openssh-6.6p1/sshd_config.0
|
diff --git a/openssh-7.2p2/sshd_config.0 b/openssh-7.2p2/sshd_config.0
|
||||||
--- a/openssh-6.6p1/sshd_config.0
|
--- a/openssh-7.2p2/sshd_config.0
|
||||||
+++ b/openssh-6.6p1/sshd_config.0
|
+++ b/openssh-7.2p2/sshd_config.0
|
||||||
@@ -728,16 +728,24 @@ DESCRIPTION
|
@@ -946,16 +946,24 @@ DESCRIPTION
|
||||||
|
|
||||||
Because PAM challenge-response authentication usually serves an
|
Because PAM challenge-response authentication usually serves an
|
||||||
equivalent role to password authentication, you should disable
|
equivalent role to password authentication, you should disable
|
||||||
either PasswordAuthentication or ChallengeResponseAuthentication.
|
either PasswordAuthentication or ChallengeResponseAuthentication.
|
||||||
|
|
||||||
If UsePAM is enabled, you will not be able to run sshd(8) as a
|
If UsePAM is enabled, you will not be able to run sshd(8) as a
|
||||||
non-root user. The default is ``no''.
|
non-root user. The default is M-bM-^@M-^\noM-bM-^@M-^].
|
||||||
|
|
||||||
+ UsePAMCheckLocks
|
+ UsePAMCheckLocks
|
||||||
+ When set to ``yes'', the checks whether the account has been
|
+ When set to ``yes'', the checks whether the account has been
|
||||||
@ -191,11 +194,11 @@ diff --git a/openssh-6.6p1/sshd_config.0 b/openssh-6.6p1/sshd_config.0
|
|||||||
that has the privilege of the authenticated user. The goal of
|
that has the privilege of the authenticated user. The goal of
|
||||||
privilege separation is to prevent privilege escalation by
|
privilege separation is to prevent privilege escalation by
|
||||||
containing any corruption within the unprivileged processes. The
|
containing any corruption within the unprivileged processes. The
|
||||||
default is ``yes''. If UsePrivilegeSeparation is set to
|
argument must be M-bM-^@M-^\yesM-bM-^@M-^], M-bM-^@M-^\noM-bM-^@M-^], or M-bM-^@M-^\sandboxM-bM-^@M-^]. If
|
||||||
diff --git a/openssh-6.6p1/sshd_config.5 b/openssh-6.6p1/sshd_config.5
|
diff --git a/openssh-7.2p2/sshd_config.5 b/openssh-7.2p2/sshd_config.5
|
||||||
--- a/openssh-6.6p1/sshd_config.5
|
--- a/openssh-7.2p2/sshd_config.5
|
||||||
+++ b/openssh-6.6p1/sshd_config.5
|
+++ b/openssh-7.2p2/sshd_config.5
|
||||||
@@ -1214,16 +1214,28 @@ or
|
@@ -1578,16 +1578,28 @@ or
|
||||||
.Pp
|
.Pp
|
||||||
If
|
If
|
||||||
.Cm UsePAM
|
.Cm UsePAM
|
@ -1,10 +1,12 @@
|
|||||||
|
# HG changeset patch
|
||||||
|
# Parent 94fb9a9ff763462af43304fc73c2913a07829226
|
||||||
# use same lines naming as utempter (prevents problems with using different
|
# use same lines naming as utempter (prevents problems with using different
|
||||||
# formats in ?tmp? files)
|
# formats in ?tmp? files)
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/loginrec.c b/openssh-6.6p1/loginrec.c
|
diff --git a/openssh-7.2p2/loginrec.c b/openssh-7.2p2/loginrec.c
|
||||||
--- a/openssh-6.6p1/loginrec.c
|
--- a/openssh-7.2p2/loginrec.c
|
||||||
+++ b/openssh-6.6p1/loginrec.c
|
+++ b/openssh-7.2p2/loginrec.c
|
||||||
@@ -538,17 +538,17 @@ getlast_entry(struct logininfo *li)
|
@@ -541,17 +541,17 @@ getlast_entry(struct logininfo *li)
|
||||||
/*
|
/*
|
||||||
* 'line' string utility functions
|
* 'line' string utility functions
|
||||||
*
|
*
|
||||||
@ -23,7 +25,7 @@ diff --git a/openssh-6.6p1/loginrec.c b/openssh-6.6p1/loginrec.c
|
|||||||
*/
|
*/
|
||||||
|
|
||||||
|
|
||||||
@@ -599,16 +599,20 @@ line_abbrevname(char *dst, const char *s
|
@@ -602,16 +602,20 @@ line_abbrevname(char *dst, const char *s
|
||||||
/* Always skip prefix if present */
|
/* Always skip prefix if present */
|
||||||
if (strncmp(src, "/dev/", 5) == 0)
|
if (strncmp(src, "/dev/", 5) == 0)
|
||||||
src += 5;
|
src += 5;
|
@ -1,24 +1,23 @@
|
|||||||
# try to remove xauth cookies on logout
|
# HG changeset patch
|
||||||
# bnc#98815
|
# Parent c7d5ac7548d3bc695559aee7e28569e422b6aadf
|
||||||
|
try to remove xauth cookies on logout
|
||||||
|
|
||||||
diff --git a/openssh-6.6p1/session.c b/openssh-6.6p1/session.c
|
bnc#98815
|
||||||
--- a/openssh-6.6p1/session.c
|
|
||||||
+++ b/openssh-6.6p1/session.c
|
|
||||||
@@ -2510,18 +2510,50 @@ session_exit_message(Session *s, int sta
|
|
||||||
if (c->ostate != CHAN_OUTPUT_CLOSED)
|
|
||||||
chan_write_failed(c);
|
|
||||||
}
|
|
||||||
|
|
||||||
void
|
diff --git a/openssh-7.2p2/session.c b/openssh-7.2p2/session.c
|
||||||
session_close(Session *s)
|
--- a/openssh-7.2p2/session.c
|
||||||
{
|
+++ b/openssh-7.2p2/session.c
|
||||||
|
@@ -2540,16 +2540,44 @@ session_close(Session *s)
|
||||||
u_int i;
|
u_int i;
|
||||||
+ int do_xauth;
|
|
||||||
|
|
||||||
debug("session_close: session %d pid %ld", s->self, (long)s->pid);
|
verbose("Close session: user %s from %.200s port %d id %d",
|
||||||
+
|
s->pw->pw_name,
|
||||||
+ do_xauth = (s->display != NULL) && (s->auth_proto != NULL) && (s->auth_data != NULL);
|
get_remote_ipaddr(),
|
||||||
+ if (do_xauth && options.xauth_location != NULL) {
|
get_remote_port(),
|
||||||
|
s->self);
|
||||||
|
|
||||||
|
+ if ((s->display != NULL) && (s->auth_proto != NULL) &&
|
||||||
|
+ (s->auth_data != NULL) && (options.xauth_location != NULL)) {
|
||||||
+ pid_t pid;
|
+ pid_t pid;
|
||||||
+ FILE *f;
|
+ FILE *f;
|
||||||
+ char cmd[1024];
|
+ char cmd[1024];
|
||||||
@ -41,9 +40,7 @@ diff --git a/openssh-6.6p1/session.c b/openssh-6.6p1/session.c
|
|||||||
+ error("Could not run %s\n", cmd);
|
+ error("Could not run %s\n", cmd);
|
||||||
+ exit(0);
|
+ exit(0);
|
||||||
+ } else if (pid > 0) {
|
+ } else if (pid > 0) {
|
||||||
+ int status;
|
+ waitpid(pid, NULL, 0);
|
||||||
+
|
|
||||||
+ waitpid(pid, &status, 0);
|
|
||||||
+ }
|
+ }
|
||||||
+ }
|
+ }
|
||||||
+
|
+
|
31
openssh-7.2p2-seccomp_getuid.patch
Normal file
31
openssh-7.2p2-seccomp_getuid.patch
Normal file
@ -0,0 +1,31 @@
|
|||||||
|
# HG changeset patch
|
||||||
|
# Parent 4f03a27aa55b0beebf232844353779e182cd2497
|
||||||
|
add 'getuid' syscall to list of allowed ones to prevent the sanboxed thread
|
||||||
|
from being killed by the seccomp filter
|
||||||
|
|
||||||
|
diff --git a/openssh-7.2p2/sandbox-seccomp-filter.c b/openssh-7.2p2/sandbox-seccomp-filter.c
|
||||||
|
--- a/openssh-7.2p2/sandbox-seccomp-filter.c
|
||||||
|
+++ b/openssh-7.2p2/sandbox-seccomp-filter.c
|
||||||
|
@@ -142,16 +142,22 @@ static const struct sock_filter preauth_
|
||||||
|
SC_ALLOW(exit_group),
|
||||||
|
#endif
|
||||||
|
#ifdef __NR_getpgid
|
||||||
|
SC_ALLOW(getpgid),
|
||||||
|
#endif
|
||||||
|
#ifdef __NR_getpid
|
||||||
|
SC_ALLOW(getpid),
|
||||||
|
#endif
|
||||||
|
+#ifdef __NR_getuid
|
||||||
|
+ SC_ALLOW(getuid),
|
||||||
|
+#endif
|
||||||
|
+#ifdef __NR_getuid32
|
||||||
|
+ SC_ALLOW(getuid32),
|
||||||
|
+#endif
|
||||||
|
#ifdef __NR_getrandom
|
||||||
|
SC_ALLOW(getrandom),
|
||||||
|
#endif
|
||||||
|
#ifdef __NR_gettimeofday
|
||||||
|
SC_ALLOW(gettimeofday),
|
||||||
|
#endif
|
||||||
|
#ifdef __NR_madvise
|
||||||
|
SC_ALLOW(madvise),
|
30
openssh-7.2p2-seccomp_stat.patch
Normal file
30
openssh-7.2p2-seccomp_stat.patch
Normal file
@ -0,0 +1,30 @@
|
|||||||
|
# HG changeset patch
|
||||||
|
# Parent 51a94ce61ff5c6908d747d8bc5806e18c6f5c114
|
||||||
|
Allow the stat() syscall for OpenSSL re-seed patch
|
||||||
|
(which causes OpenSSL use stat() on some file)
|
||||||
|
|
||||||
|
bnc#912436
|
||||||
|
|
||||||
|
diff --git a/openssh-7.2p2/sandbox-seccomp-filter.c b/openssh-7.2p2/sandbox-seccomp-filter.c
|
||||||
|
--- a/openssh-7.2p2/sandbox-seccomp-filter.c
|
||||||
|
+++ b/openssh-7.2p2/sandbox-seccomp-filter.c
|
||||||
|
@@ -130,16 +130,19 @@ static const struct sock_filter preauth_
|
||||||
|
SC_ALLOW(brk),
|
||||||
|
#endif
|
||||||
|
#ifdef __NR_clock_gettime
|
||||||
|
SC_ALLOW(clock_gettime),
|
||||||
|
#endif
|
||||||
|
#ifdef __NR_close
|
||||||
|
SC_ALLOW(close),
|
||||||
|
#endif
|
||||||
|
+#ifdef __NR_stat
|
||||||
|
+ SC_ALLOW(stat),
|
||||||
|
+#endif
|
||||||
|
#ifdef __NR_exit
|
||||||
|
SC_ALLOW(exit),
|
||||||
|
#endif
|
||||||
|
#ifdef __NR_exit_group
|
||||||
|
SC_ALLOW(exit_group),
|
||||||
|
#endif
|
||||||
|
#ifdef __NR_getpgid
|
||||||
|
SC_ALLOW(getpgid),
|
53
openssh-7.2p2-send_locale.patch
Normal file
53
openssh-7.2p2-send_locale.patch
Normal file
@ -0,0 +1,53 @@
|
|||||||
|
# HG changeset patch
|
||||||
|
# Parent fdeedfd2266d642837d86b9b7b3cdc6c00e9535d
|
||||||
|
send locales in default configuration
|
||||||
|
bnc#65747
|
||||||
|
|
||||||
|
diff --git a/openssh-7.2p2/ssh_config b/openssh-7.2p2/ssh_config
|
||||||
|
--- a/openssh-7.2p2/ssh_config
|
||||||
|
+++ b/openssh-7.2p2/ssh_config
|
||||||
|
@@ -26,16 +26,21 @@ Host *
|
||||||
|
# security reasons: Someone stealing the authentification data on the
|
||||||
|
# remote side (the "spoofed" X-server by the remote sshd) can read your
|
||||||
|
# keystrokes as you type, just like any other X11 client could do.
|
||||||
|
# Set this to "no" here for global effect or in your own ~/.ssh/config
|
||||||
|
# file if you want to have the remote X11 authentification data to
|
||||||
|
# expire after twenty minutes after remote login.
|
||||||
|
ForwardX11Trusted yes
|
||||||
|
|
||||||
|
+# This enables sending locale enviroment variables LC_* LANG, see ssh_config(5).
|
||||||
|
+ SendEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
|
||||||
|
+ SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
|
||||||
|
+ SendEnv LC_IDENTIFICATION LC_ALL
|
||||||
|
+
|
||||||
|
# RhostsRSAAuthentication no
|
||||||
|
# RSAAuthentication yes
|
||||||
|
# PasswordAuthentication yes
|
||||||
|
# HostbasedAuthentication no
|
||||||
|
# GSSAPIAuthentication no
|
||||||
|
# GSSAPIDelegateCredentials no
|
||||||
|
# BatchMode no
|
||||||
|
# CheckHostIP yes
|
||||||
|
diff --git a/openssh-7.2p2/sshd_config b/openssh-7.2p2/sshd_config
|
||||||
|
--- a/openssh-7.2p2/sshd_config
|
||||||
|
+++ b/openssh-7.2p2/sshd_config
|
||||||
|
@@ -120,14 +120,19 @@ X11Forwarding yes
|
||||||
|
#VersionAddendum none
|
||||||
|
|
||||||
|
# no default banner path
|
||||||
|
#Banner none
|
||||||
|
|
||||||
|
# override default of no subsystems
|
||||||
|
Subsystem sftp /usr/libexec/sftp-server
|
||||||
|
|
||||||
|
+# This enables accepting locale enviroment variables LC_* LANG, see sshd_config(5).
|
||||||
|
+AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
|
||||||
|
+AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
|
||||||
|
+AcceptEnv LC_IDENTIFICATION LC_ALL
|
||||||
|
+
|
||||||
|
# Example of overriding settings on a per-user basis
|
||||||
|
#Match User anoncvs
|
||||||
|
# X11Forwarding no
|
||||||
|
# AllowTcpForwarding no
|
||||||
|
# PermitTTY no
|
||||||
|
# ForceCommand cvs server
|
3
openssh-7.2p2.tar.gz
Normal file
3
openssh-7.2p2.tar.gz
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
version https://git-lfs.github.com/spec/v1
|
||||||
|
oid sha256:a72781d1a043876a224ff1b0032daa4094d87565a68528759c1c2cab5482548c
|
||||||
|
size 1499808
|
@ -1,3 +1,13 @@
|
|||||||
|
-------------------------------------------------------------------
|
||||||
|
Sun Apr 17 23:27:51 UTC 2016 - pcerny@suse.com
|
||||||
|
|
||||||
|
- upgrade to 7.2p2
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Tue Feb 10 13:28:56 UTC 2015 - pcerny@suse.com
|
||||||
|
|
||||||
|
- changing license to 2-clause BSD to match source
|
||||||
|
|
||||||
-------------------------------------------------------------------
|
-------------------------------------------------------------------
|
||||||
Fri Apr 11 21:50:51 UTC 2014 - pcerny@suse.com
|
Fri Apr 11 21:50:51 UTC 2014 - pcerny@suse.com
|
||||||
|
|
||||||
|
@ -26,11 +26,11 @@ BuildRequires: openssl-devel
|
|||||||
BuildRequires: pam-devel
|
BuildRequires: pam-devel
|
||||||
BuildRequires: tcpd-devel
|
BuildRequires: tcpd-devel
|
||||||
BuildRequires: update-desktop-files
|
BuildRequires: update-desktop-files
|
||||||
Version: 6.6p1
|
Version: 7.2p2
|
||||||
Release: 0
|
Release: 0
|
||||||
Requires: openssh = %{version}
|
Requires: openssh = %{version}
|
||||||
Summary: A GNOME-Based Passphrase Dialog for OpenSSH
|
Summary: A GNOME-Based Passphrase Dialog for OpenSSH
|
||||||
License: BSD-3-Clause
|
License: BSD-2-Clause
|
||||||
Group: Productivity/Networking/SSH
|
Group: Productivity/Networking/SSH
|
||||||
Url: http://www.openssh.com/
|
Url: http://www.openssh.com/
|
||||||
%define _name openssh
|
%define _name openssh
|
||||||
|
@ -1,3 +1,40 @@
|
|||||||
|
-------------------------------------------------------------------
|
||||||
|
Mon May 30 00:30:16 UTC 2016 - pcerny@suse.com
|
||||||
|
|
||||||
|
- enable trusted X11 forwarding by default
|
||||||
|
[-X11_trusted_forwarding]
|
||||||
|
- set UID for lastlog properly [-lastlog]
|
||||||
|
- enable use of PAM by default [-enable_PAM_by_default]
|
||||||
|
- copy command line arguments properly [-saveargv-fix]
|
||||||
|
- do not use pthreads in PAM code [-dont_use_pthreads_in_PAM]
|
||||||
|
- fix paths in documentation [-eal3]
|
||||||
|
- prevent race consitions triggered by SIGALRM [-blocksigalrm]
|
||||||
|
- do send and accept locale environment variables by default
|
||||||
|
[-send_locale]
|
||||||
|
- handle hostnames changes during X forwarding
|
||||||
|
[-hostname_changes_when_forwarding_X]
|
||||||
|
- try to remove xauth cookies on exit
|
||||||
|
[-remove_xauth_cookies_on_exit]
|
||||||
|
- properly format pts names for ?tmp? log files
|
||||||
|
[-pts_names_formatting]
|
||||||
|
- check locked accounts when using PAM [-pam_check_locks]
|
||||||
|
- chenge default PermitRootLogin to 'yes' to prevent unwanted
|
||||||
|
surprises on updates from older versions.
|
||||||
|
See README.SUSE for details
|
||||||
|
[-allow_root_password_login]
|
||||||
|
- Disable DH parameters under 2048 bits by default and allow
|
||||||
|
lowering the limit back to the RFC 4419 specified minimum
|
||||||
|
through an option (bsc#932483, bsc#948902)
|
||||||
|
[-disable_short_DH_parameters]
|
||||||
|
- Add getuid() and stat() syscalls to the seccomp filter
|
||||||
|
(bsc#912436)
|
||||||
|
[-seccomp_getuid, -seccomp_stat]
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Fri May 27 23:27:51 UTC 2016 - pcerny@suse.com
|
||||||
|
|
||||||
|
- upgrade to 7.2p2 - upstream package without any SUSE patches
|
||||||
|
|
||||||
-------------------------------------------------------------------
|
-------------------------------------------------------------------
|
||||||
Fri Apr 29 15:56:38 UTC 2016 - pcerny@suse.com
|
Fri Apr 29 15:56:38 UTC 2016 - pcerny@suse.com
|
||||||
|
|
||||||
|
@ -1,75 +0,0 @@
|
|||||||
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
|
||||||
Version: GnuPG v2
|
|
||||||
|
|
||||||
mQGdBFKmggUBDICUNqm4cNh7tdEbwaNhbnwqLiHpILeXT6sddGI0Stz5ofB1uvIH
|
|
||||||
m9kXYG5XUUwlc5ywjIZm2JeuKqrd/6wAz5laLagFA6k86EZzzuBE3b5FxSQ4EN4K
|
|
||||||
5XZEJo61xASEF7z1mQCiqoA6/F407ht7nNoiVE95kOmqJlv4cqbpCw3n8f2VW+mV
|
|
||||||
UH6MYRZVrYAC9NnJWv24rem2fjgFhNT1/bx44G7H9bVJqL7hMEGa+xYQBI3YT/ul
|
|
||||||
Eu9HYmLFVeiZm1gB1eKXW7jS4ctLl5uPrxayA5DX/qNB2yqgVVlIKFwUm8gGPGPO
|
|
||||||
nsNKo0xBseE7E0F/KeGpaT5aS9yFgPm9A652Jx9felYgb0e9Ipt3lxriPQwgF/cx
|
|
||||||
LGuP/WEbN5fpWFnuV0ViklusuVI2e8GHJGU5bQD5AlzvWu4Sv6oBOcDCabScydY7
|
|
||||||
IxPBk/XBWCF9QDIa2qa32Mc9dYc8EnJszPeVCHX5hG23omDRmdLGLwH7F+CuBvCx
|
|
||||||
AKCymZtJl5DhRmnhdzRg9d+0VG4hLF7O06ANABEBAAG0H0RhbWllbiBNaWxsZXIg
|
|
||||||
PGRqbUBtaW5kcm90Lm9yZz6IRgQQEQIABgUCUqaL3wAKCRDOjssDhv+cSJ3/AJ9A
|
|
||||||
OzD63ySM9nuuN1RFeAF93TvfiACfTDrEIgeC56rU3HPTQTB3/VSxOOiIRgQQEQIA
|
|
||||||
BgUCUySGrwAKCRCL2C5vMLlLXMCbAKCAGwbnFNCw8bdGjwaki24gkEaZmwCgkxGd
|
|
||||||
ELraZAovvTR0eTj0gUvuwfqIRgQQEQgABgUCUunoHgAKCRDJgoDHj/T6aQDxAJ0V
|
|
||||||
2/z0s2QB7VYraCmN1bibFdUKxQCbB/34YVXDHr3IpNfByu+/b2CUPVaJARwEEAEC
|
|
||||||
AAYFAlSaCosACgkQX44uZGtPstCdXQf6AzFR2af55lQ37p/IB/VMweJ+neq+p0rT
|
|
||||||
mwvY0hjivPsaBhtvcvvAfjnD7O24TqmZ2DgnAIaKOndXyq7IgJu9T3hhNu7+fsTe
|
|
||||||
vlT0fgldS5b30a0wvq/QmeansC2GawxXBMWgyPx/OzNFOOHQtbFswg/8Fduv3W2F
|
|
||||||
/QD0vY4EV4cJe2mvwmdMriWQO3BHDk8pkdA9SU/TtHYqLqm9r3p4+C0aemcvyf1m
|
|
||||||
XC+DmYJKxA5C/xHv7sZyYapJY4RxQHrsYXgBWwYyoSP/0FFix2NajMTuirrQXAau
|
|
||||||
D4cRpM7tOjcQpYjfWllT67daAYTtwfzb9iC0JB2ApjMMBP0BAUANEIkBzQQTAQIA
|
|
||||||
JwIbAwUJDUfrsQIeAQIXgAUCUqaMnAQLCQgHBhUKCQgLAgUWAgMBAAAKCRDT5fVr
|
|
||||||
bZINMHZMDH0TWjM8kpQZYk9l5+qxKvwqw7oOndC4+vDZnCCjZB94JP67M0DkAoIM
|
|
||||||
gBpgSlVtCy+7iwPLx0BbX4cQ0LFWsxdYb5IfjWVx0B0jiKjQ8YdVAOXjZHmNfd72
|
|
||||||
l+NgJAAtW/kENd10rrTnifLESa51DcgIUJhchypBsDWd+PdSTTqMaG4z30Hb9qRv
|
|
||||||
EKgVKJRf24cNko1gAalTv8UIX3EJkXgp31PC/LLXuMMiDuSbf9DgnL75U/wXK8Tk
|
|
||||||
mMF0tFBIHNIb0YKO/1/IpZbtLRsxjgPdIoq38mbVdyEQyClGvh4GmAKzevE7WFeP
|
|
||||||
Oqbe173u7Lr+rwK4lS26kmw8pz1aHj6iBRmJ8LS1rtSvFmnzJlNG89JTFiuW8PMz
|
|
||||||
fZUMtDcVfpjaLhU2jjw9IkwD4E9THsNNxkohe3jnvOwsPiMXixF3A6T9AX8ZcKQf
|
|
||||||
YYDIodYI9cg576MheCK5qNypmb1wBaMveGJ1KiEp95+8qTOyDvmYOaOG8C0Odwhu
|
|
||||||
YiYk2Nch7Y9BTiJj1WrmLS+VpUqAGApKiQIcBBABAgAGBQJTF5i3AAoJECPNT7oM
|
|
||||||
AX3yAaoP/jSWlN++0Sms0WgN67JHDZhXpU+uiumaKS2VXXakIeAKu8kra6KIqmTa
|
|
||||||
dmm1zSJ83yhr6q3TjnCaOMLcSCEaCeizeMHeUbLPiM1zlcXH3jqpZxIPJ2lZTsyS
|
|
||||||
eAEAQwT30NIjySlOX5Ba/ZknQ8iiqqkZM1PBxqYIcjN8ijOY59L4NQnTsdn0m6pA
|
|
||||||
e1m16zD3sGljVvJeQuvoyaqxnOEQhzfnYjziFIkTbRKh0bk2jq3GjpYKjm0H0yDz
|
|
||||||
r1xcG5R31DZb+n5tWDKDYUX+PtDh8ypgzobTBQ1JTl7e2qeu/EpbFccRqsu1S9kJ
|
|
||||||
yC3jyYzpk2Bf8mfsfH6Z+FUR8AEKW67vBQQFRIV0H4WCBazI2k1/ibNoaLqKJNDh
|
|
||||||
0j3p89XAdlXdie8Cr+kd0XQJ/ExqaBPpTiVWGFeEVxo9cC18zFv8N8ZvOnEBwJZ7
|
|
||||||
7uaiKYAjNUEfE8W7RX0bZgkIS5gXcuFRgLDcHqWEhFTasSObmNx8rrbmkZUnyuct
|
|
||||||
CFu3iYAAOvpBZNEXXnwU5S//G19gjfNlLQSBcCn6A4fJo1szPhC9VD9suf21FkZY
|
|
||||||
Z2dGT1U1CYmw46wsb6ZyG8hd56fD3VkMF6fs123NuCmKJwdv4dCAtKXeizm3Kwuq
|
|
||||||
fiItPr+CZlF7fgBSvxSllErP3fRio6w6ueu/2nMdxq/+VqSSfi0jiQIcBBABAgAG
|
|
||||||
BQJTGxrFAAoJEGXrljbwLFcEA1wQALFhneSP944km15LMqr4AGOaStxSWv+Fr3Nc
|
|
||||||
Dv/LXOZ9olMHGZIrAV2yl6hW0vPOiQXJGM2+t1H5Q2gbktPt/F5LD/lR8cxMOCfD
|
|
||||||
bVA5nUzi52mY7J6rv15AmJNzlxOrUsOxGIp2AuBFI+NLcmzW1vA4VN8oY22zePYS
|
|
||||||
sAyANODpYLwzmLvWh/n6Gkb9Dcr5d5M6clPJlvyCjT3HOkmLCPBTv/I4lm004pLW
|
|
||||||
+pepwfmHi1XoXDXLChrBU0caV63+KdIKaSkZafGhhdOSeMT2ti6squ+9VBm6g207
|
|
||||||
ZaU46wzATdVfCJkhAPk8HMi/853vqXPhl06VFi3KYrL6tsSie0X6vNlMfkQ1obdh
|
|
||||||
2KHVtqSFhO+0pwjLQ6Ei5X0MIYk2M8XFUIV1RPmQ4RdvfbMuJpyXLBxTY2ItB70Z
|
|
||||||
HvEmXOTYLYAhAH+UvSODocIP24I/mdyPbiTxgpYVa8pMFw70aA/1zPWftZCYWe0l
|
|
||||||
98imcUW2YPknLl3bxOV+CI4g5XFW/84qxS1Ty228vIK7GmnZx2AMyaSA0w84d9wQ
|
|
||||||
nxJcrNSS1M3uYvHLICEr4HWP+lTj8wFd3kd0URnB8Ybc7zsy/Rroy/KPKArhbCHb
|
|
||||||
9O+w+KuC5f1Bu4uZc/o2Zckp5zfKI7xtUbW914PB9hbo+TXkTBre9nZkSQjODL6w
|
|
||||||
PLIanYFvuQGdBFKmggUBDIDU53B+nBcpyH47TRbUWxBIxwSNqEaajzhZOugz+qNN
|
|
||||||
3tiyV3fTQ8y/fCRCfZZ2HJNxr8SaRbR9VMZJiztne/lKk9/SmthKOZ+7xaVejPrg
|
|
||||||
Cl1eoYeOP0oB6rY65S1avChuCJATNTgfGXP3hf/rkGAbmTs5PITcnpuBFwzAkKAK
|
|
||||||
TCMrznBtsGQYf4mj2j9nD1M9zNBwTsGYZiSQs0BdvDuiYoE4vhnrD2xdOjP1SdDQ
|
|
||||||
QH2zhO8BscYpf3LY8RCNk37CTNHcNq9YHuqXy8dkhGaykCwMAm8NPWh+w227wwHz
|
|
||||||
AlzG9lqhnuP3BQtimdo1jH3HESGBsH2jWYFxix0OPfHPmOuC2r9yl2AYLpuD5rAN
|
|
||||||
z/KVDWY2CUp9jw/2EUiEgA1mKWeYCWTkZKhZyU//r2b67fgoqgdThhzcjWk81wvo
|
|
||||||
3KLRuHyYep71Z50p+h3tjjIzVLbR9dpLi+ssiUqDFuwOlaJauTSW1XTe7ILt6oN7
|
|
||||||
efPMZb/YYtMePnGwDb4fAa0+ibmabOO9Xk8U2lLtr3QlABEBAAGJAbUEGAECAA8F
|
|
||||||
AlKmggUCGwwFCQ1H67EACgkQ0+X1a22SDTARJwx/ZCMNabddrAnE0DymqrGsV5MS
|
|
||||||
j4YRLOdVFNR6mutQV3UYfDfepoC+ouLFn7Hxyv7UaP98l3l6IhUl9EthteULyy7w
|
|
||||||
lleeB9fRWG4xxShv8VOKR+lyhiRHOuJSwkQHf86aOUuMaCdCbkbP1NXWK3IXdvOg
|
|
||||||
eRHyy9YQoorM2ggQ8ctTfLtupKQ6uOdjdtl91VGHrXxduNXbw0y6hmxXwTik65Cj
|
|
||||||
L7ezkiOYh/+aRKIUTdUnB1o96bbdSxdq0Vv96gL8CGLSIJ3/yKgXCL6gdPY+e30e
|
|
||||||
vNUXoTyAFU7e8qjpQmANOv1C3bs1zp4cvQ7mPnSKez2hv/cOg4Lc/kDTzOGX7Djr
|
|
||||||
rIYS/n4Sz+6xQCz/ieDiSwjcNMsr1iCPvSXmgG4wVh3dvkoZV8AiUZzmbAg4gbjV
|
|
||||||
gsjNlOsa465PKaPAJ0L1xRknpHYK/9XHSG1nSGoN3JoM7Qij04b9bazZPvXrS1j2
|
|
||||||
JzgzAEIV6bPAUQsgEggc1j+f/CybFAaQjc6Pzomk5VWBHmVdZH4GsZwGORITKA==
|
|
||||||
=qGXK
|
|
||||||
-----END PGP PUBLIC KEY BLOCK-----
|
|
207
openssh.spec
207
openssh.spec
@ -86,25 +86,19 @@ BuildRequires: pam-devel
|
|||||||
%if %{uses_systemd}
|
%if %{uses_systemd}
|
||||||
BuildRequires: pkgconfig(systemd)
|
BuildRequires: pkgconfig(systemd)
|
||||||
%{?systemd_requires}
|
%{?systemd_requires}
|
||||||
%else
|
|
||||||
PreReq: %{insserv_prereq}
|
|
||||||
%endif
|
%endif
|
||||||
PreReq: pwdutils %{fillup_prereq} coreutils
|
BuildRequires: tcpd-devel
|
||||||
Conflicts: nonfreessh
|
PreReq: pwdutils %{insserv_prereq} %{fillup_prereq} coreutils
|
||||||
Recommends: xauth
|
Version: 7.2p2
|
||||||
Recommends: %{name}-helpers
|
|
||||||
Version: 6.6p1
|
|
||||||
Release: 0
|
Release: 0
|
||||||
Summary: Secure Shell Client and Server (Remote Login Program)
|
Summary: Secure Shell Client and Server (Remote Login Program)
|
||||||
License: BSD-3-Clause and MIT
|
License: BSD-2-Clause and MIT
|
||||||
Group: Productivity/Networking/SSH
|
Group: Productivity/Networking/SSH
|
||||||
Url: http://www.openssh.com/
|
Url: http://www.openssh.com/
|
||||||
Source: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
|
Source: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
|
||||||
Source42: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc
|
|
||||||
Source43: openssh.keyring
|
|
||||||
Source1: sshd.init
|
Source1: sshd.init
|
||||||
Source2: sshd.pamd
|
Source2: sshd.pamd
|
||||||
Source3: README.SuSE
|
Source3: README.SUSE
|
||||||
Source4: README.kerberos
|
Source4: README.kerberos
|
||||||
Source5: ssh.reg
|
Source5: ssh.reg
|
||||||
Source6: ssh-askpass
|
Source6: ssh-askpass
|
||||||
@ -112,49 +106,31 @@ Source7: sshd.fw
|
|||||||
Source8: sysconfig.ssh
|
Source8: sysconfig.ssh
|
||||||
Source9: sshd-gen-keys-start
|
Source9: sshd-gen-keys-start
|
||||||
Source10: sshd.service
|
Source10: sshd.service
|
||||||
Patch0: openssh-6.6p1-curve25519-6.6.1p1.patch
|
Source11: README.FIPS
|
||||||
Patch1: openssh-6.6p1-key-converter.patch
|
Source12: cavs_driver-ssh.pl
|
||||||
Patch2: openssh-6.6p1-X11-forwarding.patch
|
Patch00: openssh-7.2p2-allow_root_password_login.patch
|
||||||
Patch3: openssh-6.6p1-lastlog.patch
|
Patch01: openssh-7.2p2-X11_trusted_forwarding.patch
|
||||||
Patch4: openssh-6.6p1-pam-fix2.patch
|
Patch02: openssh-7.2p2-lastlog.patch
|
||||||
Patch5: openssh-6.6p1-saveargv-fix.patch
|
Patch03: openssh-7.2p2-enable_PAM_by_default.patch
|
||||||
Patch6: openssh-6.6p1-pam-fix3.patch
|
Patch04: openssh-7.2p2-dont_use_pthreads_in_PAM.patch
|
||||||
Patch7: openssh-6.6p1-gssapimitm.patch
|
Patch05: openssh-7.2p2-eal3.patch
|
||||||
Patch8: openssh-6.6p1-eal3.patch
|
Patch06: openssh-7.2p2-blocksigalrm.patch
|
||||||
Patch9: openssh-6.6p1-blocksigalrm.patch
|
Patch07: openssh-7.2p2-send_locale.patch
|
||||||
Patch10: openssh-6.6p1-send_locale.patch
|
Patch08: openssh-7.2p2-hostname_changes_when_forwarding_X.patch
|
||||||
Patch11: openssh-6.6p1-xauthlocalhostname.patch
|
Patch09: openssh-7.2p2-remove_xauth_cookies_on_exit.patch
|
||||||
Patch12: openssh-6.6p1-xauth.patch
|
Patch10: openssh-7.2p2-pts_names_formatting.patch
|
||||||
Patch13: openssh-6.6p1-default-protocol.patch
|
Patch11: openssh-7.2p2-pam_check_locks.patch
|
||||||
Patch14: openssh-6.6p1-pts.patch
|
Patch12: openssh-7.2p2-disable_short_DH_parameters.patch
|
||||||
Patch15: openssh-6.6p1-pam-check-locks.patch
|
Patch13: openssh-7.2p2-seccomp_getuid.patch
|
||||||
Patch16: openssh-6.6p1-fingerprint_hash.patch
|
Patch14: openssh-7.2p2-seccomp_stat.patch
|
||||||
Patch17: openssh-6.6p1-fips.patch
|
|
||||||
Patch18: openssh-6.6p1-audit1-remove_duplicit_audit.patch
|
|
||||||
Patch19: openssh-6.6p1-audit2-better_audit_of_user_actions.patch
|
|
||||||
Patch20: openssh-6.6p1-audit3-key_auth_usage.patch
|
|
||||||
Patch21: openssh-6.6p1-audit3-key_auth_usage-fips.patch
|
|
||||||
Patch22: openssh-6.6p1-audit4-kex_results.patch
|
|
||||||
Patch23: openssh-6.6p1-audit4-kex_results-fips.patch
|
|
||||||
Patch24: openssh-6.6p1-audit5-session_key_destruction.patch
|
|
||||||
Patch25: openssh-6.6p1-audit6-server_key_destruction.patch
|
|
||||||
Patch26: openssh-6.6p1-audit7-libaudit_compat.patch
|
|
||||||
Patch27: openssh-6.6p1-audit8-libaudit_dns_timeouts.patch
|
|
||||||
Patch28: openssh-6.6p1-seed-prng.patch
|
|
||||||
Patch29: openssh-6.6p1-gssapi_key_exchange.patch
|
|
||||||
Patch30: openssh-6.6p1-login_options.patch
|
|
||||||
Patch31: openssh-6.6p1-disable-openssl-abi-check.patch
|
|
||||||
Patch32: openssh-6.6p1-no_fork-no_pid_file.patch
|
|
||||||
Patch33: openssh-6.6p1-host_ident.patch
|
|
||||||
Patch34: openssh-6.6p1-sftp_homechroot.patch
|
|
||||||
Patch35: openssh-6.6p1-sftp_force_permissions.patch
|
|
||||||
Patch36: openssh-6.6p1-seccomp_getuid.patch
|
|
||||||
Patch37: openssh-6.6p1-seccomp_stat.patch
|
|
||||||
Patch38: openssh-6.6p1-X_forward_with_disabled_ipv6.patch
|
|
||||||
Patch39: openssh-6.6p1-fips-checks.patch
|
|
||||||
Patch40: openssh-6.6p1-ldap.patch
|
|
||||||
Patch41: CVE-2016-0777_CVE-2016-0778.patch
|
|
||||||
BuildRoot: %{_tmppath}/%{name}-%{version}-build
|
BuildRoot: %{_tmppath}/%{name}-%{version}-build
|
||||||
|
Conflicts: nonfreessh
|
||||||
|
Recommends: audit
|
||||||
|
Recommends: xauth
|
||||||
|
Recommends: %{name}-helpers = %{version}-%{release}
|
||||||
|
Conflicts: %{name}-fips < %{version}-%{release} , %{name}-fips > %{version}-%{release}
|
||||||
|
%define CHECKSUM_SUFFIX .hmac
|
||||||
|
%define CHECKSUM_HMAC_KEY "HMAC_KEY:OpenSSH-FIPS@SLE"
|
||||||
|
|
||||||
%description
|
%description
|
||||||
SSH (Secure Shell) is a program for logging into and executing commands
|
SSH (Secure Shell) is a program for logging into and executing commands
|
||||||
@ -169,76 +145,58 @@ also be forwarded over the secure channel.
|
|||||||
%package helpers
|
%package helpers
|
||||||
Summary: OpenSSH AuthorizedKeysCommand helpers
|
Summary: OpenSSH AuthorizedKeysCommand helpers
|
||||||
Group: Productivity/Networking/SSH
|
Group: Productivity/Networking/SSH
|
||||||
Requires: openssh
|
Requires: %{name} = %{version}-%{release}
|
||||||
|
|
||||||
%description helpers
|
%description helpers
|
||||||
Helper applications for OpenSSH which retrieve keys from various sources.
|
Helper applications for OpenSSH which retrieve keys from various sources.
|
||||||
|
|
||||||
|
|
||||||
%package fips
|
%package fips
|
||||||
Summary: OpenSSH FIPS cryptomodule hashes
|
Summary: OpenSSH FIPS cryptomodule HMACs
|
||||||
Group: Productivity/Networking/SSH
|
Group: Productivity/Networking/SSH
|
||||||
Requires: openssh
|
Requires: %{name} = %{version}-%{release}
|
||||||
|
Conflicts: %{name} < %{version}-%{release} , %{name} > %{version}-%{release}
|
||||||
|
Obsoletes: %{name}-hmac
|
||||||
|
|
||||||
%description fips
|
%description fips
|
||||||
Hashes that together with the main package form the FIPS certifiable
|
Hashes that together with the main package form the FIPS certifiable
|
||||||
cryptomodule.
|
cryptomodule.
|
||||||
|
|
||||||
|
|
||||||
|
%package cavs
|
||||||
|
Summary: OpenSSH FIPS cryptomodule CAVS tests
|
||||||
|
Group: Productivity/Networking/SSH
|
||||||
|
Requires: %{name} = %{version}-%{release}
|
||||||
|
|
||||||
|
%description cavs
|
||||||
|
FIPS140 CAVS tests related parts of the OpenSSH package
|
||||||
|
|
||||||
|
|
||||||
%prep
|
%prep
|
||||||
%setup -q
|
%setup -q
|
||||||
%patch0 -p2
|
%patch00 -p2
|
||||||
#patch1 -p2
|
%patch01 -p2
|
||||||
%patch2 -p2
|
%patch02 -p2
|
||||||
%patch3 -p2
|
%patch03 -p2
|
||||||
%patch4 -p2
|
%patch04 -p2
|
||||||
%patch5 -p2
|
%patch05 -p2
|
||||||
%patch6 -p2
|
%patch06 -p2
|
||||||
%patch7 -p2
|
%patch07 -p2
|
||||||
%patch8 -p2
|
%patch08 -p2
|
||||||
%patch9 -p2
|
%patch09 -p2
|
||||||
%patch10 -p2
|
%patch10 -p2
|
||||||
%patch11 -p2
|
%patch11 -p2
|
||||||
%patch12 -p2
|
%patch12 -p2
|
||||||
%patch13 -p2
|
%patch13 -p2
|
||||||
%patch14 -p2
|
%patch14 -p2
|
||||||
%patch15 -p2
|
cp %{SOURCE3} %{SOURCE4} %{SOURCE11} .
|
||||||
%patch16 -p2
|
|
||||||
%patch17 -p2
|
|
||||||
%patch18 -p2
|
|
||||||
%patch19 -p2
|
|
||||||
%patch20 -p2
|
|
||||||
%patch21 -p2
|
|
||||||
%patch22 -p2
|
|
||||||
%patch23 -p2
|
|
||||||
%patch24 -p2
|
|
||||||
%patch25 -p2
|
|
||||||
%patch26 -p2
|
|
||||||
%if 0%{?suse_version} > 1310
|
|
||||||
%patch27 -p2
|
|
||||||
%endif
|
|
||||||
%patch28 -p2
|
|
||||||
%patch29 -p2
|
|
||||||
%patch30 -p2
|
|
||||||
%patch31 -p2
|
|
||||||
%patch32 -p2
|
|
||||||
%patch33 -p2
|
|
||||||
%patch34 -p2
|
|
||||||
%patch35 -p2
|
|
||||||
%patch36 -p2
|
|
||||||
%patch37 -p2
|
|
||||||
%patch38 -p2
|
|
||||||
%patch39 -p2
|
|
||||||
%patch40 -p2
|
|
||||||
%patch41 -p0
|
|
||||||
cp %{SOURCE3} %{SOURCE4} .
|
|
||||||
|
|
||||||
%build
|
%build
|
||||||
# set libexec dir in the LDAP patch
|
#### set libexec dir in the LDAP patch
|
||||||
sed -i.libexec 's,@LIBEXECDIR@,%{_libexecdir}/ssh,' \
|
###sed -i.libexec 's,@LIBEXECDIR@,%{_libexecdir}/ssh,' \
|
||||||
$( grep -Rl @LIBEXECDIR@ \
|
### $( grep -Rl @LIBEXECDIR@ \
|
||||||
$( grep "^+++" %{PATCH40} | sed -r 's@^.+/([^/\t ]+).*$@\1@' )
|
### $( grep "^+++" %{PATCH40} | sed -r 's@^.+/([^/\t ]+).*$@\1@' )
|
||||||
)
|
### )
|
||||||
|
|
||||||
autoreconf -fiv
|
autoreconf -fiv
|
||||||
%ifarch s390 s390x %sparc
|
%ifarch s390 s390x %sparc
|
||||||
@ -247,22 +205,17 @@ PIEFLAGS="-fPIE"
|
|||||||
PIEFLAGS="-fpie"
|
PIEFLAGS="-fpie"
|
||||||
%endif
|
%endif
|
||||||
CFLAGS="%{optflags} $PIEFLAGS -fstack-protector"
|
CFLAGS="%{optflags} $PIEFLAGS -fstack-protector"
|
||||||
#%if 0%{?suse_version} < 1230
|
|
||||||
#CFLAGS="-lrt $CFLAGS"
|
|
||||||
#%endif
|
|
||||||
CXXFLAGS="%{optflags} $PIEFLAGS -fstack-protector"
|
CXXFLAGS="%{optflags} $PIEFLAGS -fstack-protector"
|
||||||
LDFLAGS="-pie -Wl,--as-needed"
|
LDFLAGS="-pie -Wl,--as-needed"
|
||||||
#%if 0%{?suse_version} < 1230
|
|
||||||
#LDFLAGS="-lrt $LDFLAGS"
|
|
||||||
#%endif
|
|
||||||
#CPPFLAGS="%{optflags} -DUSE_INTERNAL_B64"
|
#CPPFLAGS="%{optflags} -DUSE_INTERNAL_B64"
|
||||||
export LDFLAGS CFLAGS CXXFLAGS CPPFLAGS
|
export LDFLAGS CFLAGS CXXFLAGS CPPFLAGS
|
||||||
./configure \
|
%configure \
|
||||||
--prefix=%{_prefix} \
|
--prefix=%{_prefix} \
|
||||||
--mandir=%{_mandir} \
|
--mandir=%{_mandir} \
|
||||||
--infodir=%{_infodir} \
|
--infodir=%{_infodir} \
|
||||||
--sysconfdir=%{_sysconfdir}/ssh \
|
--sysconfdir=%{_sysconfdir}/ssh \
|
||||||
--libexecdir=%{_libexecdir}/ssh \
|
--libexecdir=%{_libexecdir}/ssh \
|
||||||
|
--with-tcp-wrappers \
|
||||||
%if %{has_libselinux}
|
%if %{has_libselinux}
|
||||||
--with-selinux \
|
--with-selinux \
|
||||||
%endif
|
%endif
|
||||||
@ -330,6 +283,7 @@ install -m 644 %{SOURCE7} %{buildroot}%{_fwdefdir}/sshd
|
|||||||
|
|
||||||
# askpass wrapper
|
# askpass wrapper
|
||||||
sed -e "s,@LIBEXECDIR@,%{_libexecdir},g" < %{SOURCE6} > %{buildroot}%{_libexecdir}/ssh/ssh-askpass
|
sed -e "s,@LIBEXECDIR@,%{_libexecdir},g" < %{SOURCE6} > %{buildroot}%{_libexecdir}/ssh/ssh-askpass
|
||||||
|
sed -e "s,@LIBEXECDIR@,%{_libexecdir},g" < %{SOURCE12} > %{buildroot}%{_libexecdir}/ssh/cavs_driver-ssh.pl
|
||||||
rm -f %{buildroot}%{_datadir}/Ssh.bin
|
rm -f %{buildroot}%{_datadir}/Ssh.bin
|
||||||
# sshd keys generator wrapper
|
# sshd keys generator wrapper
|
||||||
install -D -m 0755 %{SOURCE9} %{buildroot}%{_sbindir}/sshd-gen-keys-start
|
install -D -m 0755 %{SOURCE9} %{buildroot}%{_sbindir}/sshd-gen-keys-start
|
||||||
@ -342,13 +296,12 @@ install -D -m 0755 %{SOURCE9} %{buildroot}%{_sbindir}/sshd-gen-keys-start
|
|||||||
# this shows up earlier because otherwise the %expand of
|
# this shows up earlier because otherwise the %expand of
|
||||||
# the macro is too late.
|
# the macro is too late.
|
||||||
%{expand:%%global __os_install_post {%__os_install_post
|
%{expand:%%global __os_install_post {%__os_install_post
|
||||||
|
|
||||||
for b in \
|
for b in \
|
||||||
%{_bindir}/ssh \
|
%{_bindir}/ssh \
|
||||||
%{_sbindir}/sshd \
|
%{_sbindir}/sshd \
|
||||||
%{_libexecdir}/ssh/sftp-server \
|
%{_libexecdir}/ssh/sftp-server \
|
||||||
; do
|
; do
|
||||||
( printf "\03"; openssl dgst -sha256 -binary < %{buildroot}$b ) > %{buildroot}$b.chk
|
openssl dgst -sha256 -binary -hmac %{CHECKSUM_HMAC_KEY} < %{buildroot}$b > %{buildroot}$b%{CHECKSUM_SUFFIX}
|
||||||
done
|
done
|
||||||
|
|
||||||
}}
|
}}
|
||||||
@ -376,6 +329,10 @@ getent passwd sshd >/dev/null || %{_sbindir}/useradd -r -g sshd -d /var/lib/sshd
|
|||||||
%endif
|
%endif
|
||||||
|
|
||||||
%postun
|
%postun
|
||||||
|
# The openssh-fips trigger script for openssh will normally restart sshd once
|
||||||
|
# it gets installed, so only restart the service here is openssh-fips is not
|
||||||
|
# present
|
||||||
|
rpm -q openssh-fips >& /dev/null && DISABLE_RESTART_ON_UPDATE=yes
|
||||||
%if %{uses_systemd}
|
%if %{uses_systemd}
|
||||||
%service_del_postun sshd.service
|
%service_del_postun sshd.service
|
||||||
%else
|
%else
|
||||||
@ -383,13 +340,17 @@ getent passwd sshd >/dev/null || %{_sbindir}/useradd -r -g sshd -d /var/lib/sshd
|
|||||||
%{insserv_cleanup}
|
%{insserv_cleanup}
|
||||||
%endif
|
%endif
|
||||||
|
|
||||||
|
%triggerin -n openssh-fips -- %{name} = %{version}-%{release}
|
||||||
|
%restart_on_update sshd
|
||||||
|
|
||||||
%files
|
%files
|
||||||
%defattr(-,root,root)
|
%defattr(-,root,root)
|
||||||
%exclude %{_bindir}/*.chk
|
%exclude %{_bindir}/ssh%{CHECKSUM_SUFFIX}
|
||||||
%exclude %{_sbindir}/*.chk
|
%exclude %{_sbindir}/sshd%{CHECKSUM_SUFFIX}
|
||||||
%exclude %{_libexecdir}/ssh/sftp-server.chk
|
%exclude %{_libexecdir}/ssh/sftp-server%{CHECKSUM_SUFFIX}
|
||||||
|
%exclude %{_libexecdir}/ssh/cavs*
|
||||||
%dir %attr(755,root,root) /var/lib/sshd
|
%dir %attr(755,root,root) /var/lib/sshd
|
||||||
%doc README.SuSE README.kerberos ChangeLog OVERVIEW README TODO LICENCE CREDITS
|
%doc README.SUSE README.kerberos README.FIPS ChangeLog OVERVIEW README TODO LICENCE CREDITS
|
||||||
%attr(0755,root,root) %dir %{_sysconfdir}/ssh
|
%attr(0755,root,root) %dir %{_sysconfdir}/ssh
|
||||||
%attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/moduli
|
%attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/moduli
|
||||||
%verify(not mode) %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ssh/ssh_config
|
%verify(not mode) %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ssh/ssh_config
|
||||||
@ -405,7 +366,7 @@ getent passwd sshd >/dev/null || %{_sbindir}/useradd -r -g sshd -d /var/lib/sshd
|
|||||||
%attr(0755,root,root) %{_bindir}/*
|
%attr(0755,root,root) %{_bindir}/*
|
||||||
%attr(0755,root,root) %{_sbindir}/*
|
%attr(0755,root,root) %{_sbindir}/*
|
||||||
%attr(0755,root,root) %dir %{_libexecdir}/ssh
|
%attr(0755,root,root) %dir %{_libexecdir}/ssh
|
||||||
%exclude %{_libexecdir}/ssh/ssh-ldap*
|
###%exclude %{_libexecdir}/ssh/ssh-ldap*
|
||||||
%attr(0755,root,root) %{_libexecdir}/ssh/*
|
%attr(0755,root,root) %{_libexecdir}/ssh/*
|
||||||
%attr(0444,root,root) %doc %{_mandir}/man1/*
|
%attr(0444,root,root) %doc %{_mandir}/man1/*
|
||||||
%attr(0444,root,root) %doc %{_mandir}/man5/*
|
%attr(0444,root,root) %doc %{_mandir}/man5/*
|
||||||
@ -424,15 +385,19 @@ getent passwd sshd >/dev/null || %{_sbindir}/useradd -r -g sshd -d /var/lib/sshd
|
|||||||
%files helpers
|
%files helpers
|
||||||
%defattr(-,root,root)
|
%defattr(-,root,root)
|
||||||
%attr(0755,root,root) %dir %{_sysconfdir}/ssh
|
%attr(0755,root,root) %dir %{_sysconfdir}/ssh
|
||||||
%verify(not mode) %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ssh/ldap.conf
|
###%verify(not mode) %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ssh/ldap.conf
|
||||||
%attr(0755,root,root) %dir %{_libexecdir}/ssh
|
%attr(0755,root,root) %dir %{_libexecdir}/ssh
|
||||||
%attr(0755,root,root) %{_libexecdir}/ssh/ssh-ldap*
|
###%attr(0755,root,root) %{_libexecdir}/ssh/ssh-ldap*
|
||||||
%doc HOWTO.ldap-keys openssh-lpk-openldap.schema openssh-lpk-sun.schema
|
###%doc HOWTO.ldap-keys openssh-lpk-openldap.schema openssh-lpk-sun.schema
|
||||||
|
|
||||||
%files fips
|
%files fips
|
||||||
%defattr(-,root,root)
|
%defattr(-,root,root)
|
||||||
%attr(0444,root,root) %{_bindir}/ssh.chk
|
%attr(0444,root,root) %{_bindir}/ssh%{CHECKSUM_SUFFIX}
|
||||||
%attr(0444,root,root) %{_sbindir}/sshd.chk
|
%attr(0444,root,root) %{_sbindir}/sshd%{CHECKSUM_SUFFIX}
|
||||||
%attr(0444,root,root) %{_libexecdir}/ssh/sftp-server.chk
|
%attr(0444,root,root) %{_libexecdir}/ssh/sftp-server%{CHECKSUM_SUFFIX}
|
||||||
|
|
||||||
|
%files cavs
|
||||||
|
%defattr(-,root,root)
|
||||||
|
%attr(0755,root,root) %{_libexecdir}/ssh/cavs*
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
@ -24,13 +24,6 @@ if [ -z "$SESSION" ] ; then
|
|||||||
fi
|
fi
|
||||||
fi
|
fi
|
||||||
|
|
||||||
if [ -n "$SSH_AUTH_SOCK" ] ; then
|
|
||||||
# Ensure that ssh can use the ssh support of the gpg-agent
|
|
||||||
case "$SSH_AUTH_SOCK" in
|
|
||||||
*/S.gpg-agent.ssh) gpg-connect-agent /bye < /dev/null ;;
|
|
||||||
esac
|
|
||||||
fi
|
|
||||||
|
|
||||||
GNOME_SSH_ASKPASS="@LIBEXECDIR@/ssh/gnome-ssh-askpass"
|
GNOME_SSH_ASKPASS="@LIBEXECDIR@/ssh/gnome-ssh-askpass"
|
||||||
KDE_SSH_ASKPASS="@LIBEXECDIR@/ssh/ksshaskpass"
|
KDE_SSH_ASKPASS="@LIBEXECDIR@/ssh/ksshaskpass"
|
||||||
X11_SSH_ASKPASS="@LIBEXECDIR@/ssh/x11-ssh-askpass"
|
X11_SSH_ASKPASS="@LIBEXECDIR@/ssh/x11-ssh-askpass"
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
#! /bin/sh
|
#! /bin/sh
|
||||||
# Copyright (c) 1995-2013 SuSE GmbH Nuernberg, Germany.
|
# Copyright (c) 1995-2013 SUSE
|
||||||
#
|
#
|
||||||
# Author: Jiri Smid <feedback@suse.de>
|
# Author: Jiri Smid <feedback@suse.de>
|
||||||
#
|
#
|
||||||
@ -39,12 +39,12 @@ SSHD_PIDFILE=/var/run/sshd.init.pid
|
|||||||
# rc_reset clear local rc status (overall remains)
|
# rc_reset clear local rc status (overall remains)
|
||||||
# rc_exit exit appropriate to overall rc status
|
# rc_exit exit appropriate to overall rc status
|
||||||
|
|
||||||
soft_stop() {
|
function soft_stop () {
|
||||||
echo -n "Shutting down the listening SSH daemon"
|
echo -n "Shutting down the listening SSH daemon"
|
||||||
killproc -p $SSHD_PIDFILE -TERM $SSHD_BIN
|
killproc -p $SSHD_PIDFILE -TERM $SSHD_BIN
|
||||||
}
|
}
|
||||||
|
|
||||||
force_stop() {
|
function force_stop () {
|
||||||
echo -n "Shutting down SSH daemon *with all active connections*"
|
echo -n "Shutting down SSH daemon *with all active connections*"
|
||||||
trap '' TERM
|
trap '' TERM
|
||||||
killall sshd 2>/dev/null
|
killall sshd 2>/dev/null
|
||||||
|
Loading…
Reference in New Issue
Block a user