712ccf3395
- Update of the underlying OpenSSH to 6.4p1 - Update to 6.4p1 Features since 6.2p2: * ssh-agent(1) support in sshd(8); allows encrypted hostkeys, or hostkeys on smartcards. * ssh(1)/sshd(8): allow optional time-based rekeying via a second argument to the existing RekeyLimit option. RekeyLimit is now supported in sshd_config as well as on the client. * sshd(8): standardise logging of information during user authentication. * The presented key/cert and the remote username (if available) is now logged in the authentication success/failure message on the same log line as the local username, remote host/port and protocol in use. Certificates contents and the key fingerprint of the signing CA are logged too. * ssh(1) ability to query what cryptographic algorithms are supported in the binary. * ssh(1): ProxyCommand=- for cases where stdin and stdout already point to the proxy. * ssh(1): allow IdentityFile=none * ssh(1)/sshd(8): -E option to append debugging logs to a specified file instead of stderr or syslog. * sftp(1): support resuming partial downloads with the "reget" command and on the sftp commandline or on the "get" commandline with the "-a" (append) option. * ssh(1): "IgnoreUnknown" configuration option to selectively suppress errors arising from unknown configuration directives. * sshd(8): support for submethods to be appended to required authentication methods listed via AuthenticationMethods. OBS-URL: https://build.opensuse.org/request/show/220466 OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=58
227 lines
7.4 KiB
Diff
227 lines
7.4 KiB
Diff
# new option UsePAMCheckLocks to enforce checking for locked accounts while
|
|
# UsePAM is used
|
|
# bnc#708678, FATE#312033
|
|
|
|
diff --git a/openssh-6.4p1/auth.c b/openssh-6.4p1/auth.c
|
|
--- a/openssh-6.4p1/auth.c
|
|
+++ b/openssh-6.4p1/auth.c
|
|
@@ -103,17 +103,17 @@ allowed_user(struct passwd * pw)
|
|
struct spwd *spw = NULL;
|
|
#endif
|
|
|
|
/* Shouldn't be called if pw is NULL, but better safe than sorry... */
|
|
if (!pw || !pw->pw_name)
|
|
return 0;
|
|
|
|
#ifdef USE_SHADOW
|
|
- if (!options.use_pam)
|
|
+ if (!options.use_pam || options.use_pam_check_locks)
|
|
spw = getspnam(pw->pw_name);
|
|
#ifdef HAS_SHADOW_EXPIRE
|
|
if (!options.use_pam && spw != NULL && auth_shadow_acctexpired(spw))
|
|
return 0;
|
|
#endif /* HAS_SHADOW_EXPIRE */
|
|
#endif /* USE_SHADOW */
|
|
|
|
/* grab passwd field for locked account check */
|
|
@@ -123,17 +123,17 @@ allowed_user(struct passwd * pw)
|
|
#ifdef USE_LIBIAF
|
|
passwd = get_iaf_password(pw);
|
|
#else
|
|
passwd = spw->sp_pwdp;
|
|
#endif /* USE_LIBIAF */
|
|
#endif
|
|
|
|
/* check for locked account */
|
|
- if (!options.use_pam && passwd && *passwd) {
|
|
+ if ((!options.use_pam || options.use_pam_check_locks) && passwd && *passwd) {
|
|
int locked = 0;
|
|
|
|
#ifdef LOCKED_PASSWD_STRING
|
|
if (strcmp(passwd, LOCKED_PASSWD_STRING) == 0)
|
|
locked = 1;
|
|
#endif
|
|
#ifdef LOCKED_PASSWD_PREFIX
|
|
if (strncmp(passwd, LOCKED_PASSWD_PREFIX,
|
|
diff --git a/openssh-6.4p1/servconf.c b/openssh-6.4p1/servconf.c
|
|
--- a/openssh-6.4p1/servconf.c
|
|
+++ b/openssh-6.4p1/servconf.c
|
|
@@ -66,16 +66,17 @@ extern Buffer cfg;
|
|
|
|
void
|
|
initialize_server_options(ServerOptions *options)
|
|
{
|
|
memset(options, 0, sizeof(*options));
|
|
|
|
/* Portable-specific options */
|
|
options->use_pam = -1;
|
|
+ options->use_pam_check_locks = -1;
|
|
|
|
/* Standard Options */
|
|
options->num_ports = 0;
|
|
options->ports_from_cmdline = 0;
|
|
options->listen_addrs = NULL;
|
|
options->address_family = -1;
|
|
options->num_host_key_files = 0;
|
|
options->num_host_cert_files = 0;
|
|
@@ -157,16 +158,18 @@ initialize_server_options(ServerOptions
|
|
}
|
|
|
|
void
|
|
fill_default_server_options(ServerOptions *options)
|
|
{
|
|
/* Portable-specific options */
|
|
if (options->use_pam == -1)
|
|
options->use_pam = 0;
|
|
+ if (options->use_pam_check_locks == -1)
|
|
+ options->use_pam_check_locks = 0;
|
|
|
|
/* Standard Options */
|
|
if (options->protocol == SSH_PROTO_UNKNOWN)
|
|
options->protocol = SSH_PROTO_2;
|
|
if (options->num_host_key_files == 0) {
|
|
/* fill default hostkeys for protocols */
|
|
if (options->protocol & SSH_PROTO_1)
|
|
options->host_key_files[options->num_host_key_files++] =
|
|
@@ -315,17 +318,17 @@ fill_default_server_options(ServerOption
|
|
#endif
|
|
|
|
}
|
|
|
|
/* Keyword tokens. */
|
|
typedef enum {
|
|
sBadOption, /* == unknown option */
|
|
/* Portable-specific options */
|
|
- sUsePAM,
|
|
+ sUsePAM, sUsePAMChecklocks,
|
|
/* Standard Options */
|
|
sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime, sKeyRegenerationTime,
|
|
sPermitRootLogin, sLogFacility, sLogLevel,
|
|
sRhostsRSAAuthentication, sRSAAuthentication,
|
|
sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
|
|
sKerberosGetAFSToken,
|
|
sKerberosTgtPassing, sChallengeResponseAuthentication,
|
|
sPasswordAuthentication, sKbdInteractiveAuthentication,
|
|
@@ -360,18 +363,20 @@ typedef enum {
|
|
static struct {
|
|
const char *name;
|
|
ServerOpCodes opcode;
|
|
u_int flags;
|
|
} keywords[] = {
|
|
/* Portable-specific options */
|
|
#ifdef USE_PAM
|
|
{ "usepam", sUsePAM, SSHCFG_GLOBAL },
|
|
+ { "usepamchecklocks", sUsePAMChecklocks, SSHCFG_GLOBAL },
|
|
#else
|
|
{ "usepam", sUnsupported, SSHCFG_GLOBAL },
|
|
+ { "usepamchecklocks", sUnsupported, SSHCFG_GLOBAL },
|
|
#endif
|
|
{ "pamauthenticationviakbdint", sDeprecated, SSHCFG_GLOBAL },
|
|
/* Standard Options */
|
|
{ "port", sPort, SSHCFG_GLOBAL },
|
|
{ "hostkey", sHostKeyFile, SSHCFG_GLOBAL },
|
|
{ "hostdsakey", sHostKeyFile, SSHCFG_GLOBAL }, /* alias */
|
|
{ "hostkeyagent", sHostKeyAgent, SSHCFG_GLOBAL },
|
|
{ "pidfile", sPidFile, SSHCFG_GLOBAL },
|
|
@@ -857,16 +862,19 @@ process_server_config_line(ServerOptions
|
|
}
|
|
}
|
|
|
|
switch (opcode) {
|
|
/* Portable-specific options */
|
|
case sUsePAM:
|
|
intptr = &options->use_pam;
|
|
goto parse_flag;
|
|
+ case sUsePAMChecklocks:
|
|
+ intptr = &options->use_pam_check_locks;
|
|
+ goto parse_flag;
|
|
|
|
/* Standard Options */
|
|
case sBadOption:
|
|
return -1;
|
|
case sPort:
|
|
/* ignore ports from configfile if cmdline specifies ports */
|
|
if (options->ports_from_cmdline)
|
|
return 0;
|
|
diff --git a/openssh-6.4p1/servconf.h b/openssh-6.4p1/servconf.h
|
|
--- a/openssh-6.4p1/servconf.h
|
|
+++ b/openssh-6.4p1/servconf.h
|
|
@@ -161,16 +161,17 @@ typedef struct {
|
|
*/
|
|
|
|
u_int num_authkeys_files; /* Files containing public keys */
|
|
char *authorized_keys_files[MAX_AUTHKEYS_FILES];
|
|
|
|
char *adm_forced_command;
|
|
|
|
int use_pam; /* Enable auth via PAM */
|
|
+ int use_pam_check_locks; /* internally check for locked accounts even when using PAM */
|
|
|
|
int permit_tun;
|
|
|
|
int num_permitted_opens;
|
|
|
|
char *chroot_directory;
|
|
char *revoked_keys_file;
|
|
char *trusted_user_ca_keys;
|
|
diff --git a/openssh-6.4p1/sshd_config.0 b/openssh-6.4p1/sshd_config.0
|
|
--- a/openssh-6.4p1/sshd_config.0
|
|
+++ b/openssh-6.4p1/sshd_config.0
|
|
@@ -706,16 +706,24 @@ DESCRIPTION
|
|
|
|
Because PAM challenge-response authentication usually serves an
|
|
equivalent role to password authentication, you should disable
|
|
either PasswordAuthentication or ChallengeResponseAuthentication.
|
|
|
|
If UsePAM is enabled, you will not be able to run sshd(8) as a
|
|
non-root user. The default is ``no''.
|
|
|
|
+ UsePAMCheckLocks
|
|
+ When set to ``yes'', the checks whether the account has been
|
|
+ locked with `passwd -l' are performed even when PAM authentication
|
|
+ is enabled via UsePAM. This is to ensure that it is not possible
|
|
+ to log in with e.g. a public key (in such a case PAM is used only
|
|
+ to set up the session and some PAM modules will not check whether
|
|
+ the account is locked in this scenario). The default is ``no''.
|
|
+
|
|
UsePrivilegeSeparation
|
|
Specifies whether sshd(8) separates privileges by creating an
|
|
unprivileged child process to deal with incoming network traffic.
|
|
After successful authentication, another process will be created
|
|
that has the privilege of the authenticated user. The goal of
|
|
privilege separation is to prevent privilege escalation by
|
|
containing any corruption within the unprivileged processes. The
|
|
default is ``yes''. If UsePrivilegeSeparation is set to
|
|
diff --git a/openssh-6.4p1/sshd_config.5 b/openssh-6.4p1/sshd_config.5
|
|
--- a/openssh-6.4p1/sshd_config.5
|
|
+++ b/openssh-6.4p1/sshd_config.5
|
|
@@ -1178,16 +1178,28 @@ or
|
|
.Pp
|
|
If
|
|
.Cm UsePAM
|
|
is enabled, you will not be able to run
|
|
.Xr sshd 8
|
|
as a non-root user.
|
|
The default is
|
|
.Dq no .
|
|
+.It Cm UsePAMCheckLocks
|
|
+When set to
|
|
+.Dq yes
|
|
+, the checks whether the account has been locked with
|
|
+.Pa passwd -l
|
|
+are performed even when PAM authentication is enabled via
|
|
+.Cm UsePAM .
|
|
+This is to ensure that it is not possible to log in with e.g. a
|
|
+public key (in such a case PAM is used only to set up the session and some PAM
|
|
+modules will not check whether the account is locked in this scenario). The
|
|
+default is
|
|
+.Dq no .
|
|
.It Cm UsePrivilegeSeparation
|
|
Specifies whether
|
|
.Xr sshd 8
|
|
separates privileges by creating an unprivileged child process
|
|
to deal with incoming network traffic.
|
|
After successful authentication, another process will be created that has
|
|
the privilege of the authenticated user.
|
|
The goal of privilege separation is to prevent privilege
|