CVS log for src/usr.bin/ssh/auth.c

Up to [OpenBSD] / src / usr.bin / ssh

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

automatically order the hostkeys requested by the client based on
which hostkeys are already recorded in known_hosts. This avoids
hostkey warnings when connecting to servers with new ECDSA keys
that are preferred by default; with markus@

use strict_modes already passed as function argument over referencing
global options.strict_modes

enable certificates for hostbased authentication, from Iain Morgan;
"looks ok" markus@

queue auth debug messages for bad ownership or permissions on the user's
keyfiles. These messages will be sent after the user has successfully
authenticated (where our client will display them with LogLevel=debug).
bz#1554; ok dtucker@

add some optional indirection to matching of principal names listed
in certificates. Currently, a certificate must include the a user's name
to be accepted for authentication. This change adds the ability to
specify a list of certificate principal names that are acceptable.

When authenticating using a CA trusted through ~/.ssh/authorized_keys,
this adds a new principals="name1[,name2,...]" key option.

For CAs listed through sshd_config's TrustedCAKeys option, a new config
option "AuthorizedPrincipalsFile" specifies a per-user file containing
the list of acceptable names.

If either option is absent, the current behaviour of requiring the
username to appear in principals continues to apply.

These options are useful for role accounts, disjoint account namespaces
and "user@realm"-style naming policies in certificates.

feedback and ok markus@

make the warning for a revoked key louder and more noticable

Add a TrustedUserCAKeys option to sshd_config to specify CA keys that
are trusted to authenticate users (in addition than doing it per-user
in authorized_keys).

Add a RevokedKeys option to sshd_config and a @revoked marker to
known_hosts to allow keys to me revoked and banned for user or host
authentication.

feedback and ok markus@

unbreak ChrootDirectory+internal-sftp by skipping check for executable shell
when chrooting; reported by danh AT wzrd.com; ok dtucker@

when using ChrootDirectory, make sure we test for the existence of the
user's shell inside the chroot; bz #1679, patch from alex AT rtfs.hu;
ok dtucker

Fix a couple of typos/mispellings in comments

Output a debug if we can't open an existing keyfile.  bz#1694, ok djm@

need unistd.h for close() prototype

Merge duplicate host key file checks, based in part on a patch from Rob
Holland via bz #1348 .  Also checks for non-regular files during protocol
1 RSA auth.  ok djm@

unifdef -DBSD_AUTH
unifdef -USKEY

These options have been in use for some years;
ok markus@ "no objection" millert@

missed include bits from last commit

unifdef HAVE_LOGIN_CAP; ok deraadt@ millert@

upgrade to OpenSSH 4.4

upgrade to OpenSSH 4.4

almost entirely get rid of the culture of ".h files that include .h files"
ok djm, sort of ok stevesk
makes the pain stop in one easy step

move #include <stdio.h> out of includes.h

move #include <sys/param.h> out of includes.h

move #include <string.h> out of includes.h

Add support for conditional directives to sshd_config via a "Match" keyword,
which works similarly to the "Host" directive in ssh_config.

Lines after a Match line override the default set in the main section
if the condition on the Match line is true, eg

AllowTcpForwarding yes
Match User anoncvs
        AllowTcpForwarding no

will allow port forwarding by all users except "anoncvs".

Currently only a very small subset of directives are supported.

ok djm@

move #include <errno.h> out of includes.h; ok markus@

move #include <stdarg.h> out of includes.h; ok markus@

move #include <pwd.h> out of includes.h; ok markus@

Prevent duplicate log messages when privsep=yes; ok djm@

Put $OpenBSD$ tags back (as comments) to replace the RCSID()s that
Theo nuked - our scripts to sync -portable need them in the files

introduce xcalloc() and xasprintf() failure-checked allocations functions
and use them throughout openssh

xcalloc is particularly important because malloc(nmemb * size) is a
dangerous idiom (subject to integer overflow) and it is time for it to
die

feedback and ok deraadt@

in a switch (), break after return or goto is stupid

RCSID() can die

move #include <sys/stat.h> out of includes.h; ok markus@

move #include <paths.h> out of includes.h; ok markus@

upgrade to OpenSSH 4.2

upgrade to OpenSSH 4.2

make this -Wsign-compare clean; ok avsm@ markus@

introduce a generic %foo expansion function. replace existing % expansion and
add expansion to ControlPath; ok markus@

upgrade to OpenSSH 4.1

Populate host for log message for logins denied by AllowUsers and DenyUsers.
(bz #999); ok markus@

upgrade to OpenSSH 4.0

upgrade to OpenSSH 4.0

Log source of connections denied by AllowUsers, DenyUsers, AllowGroups and
DenyGroups.  bz #909, ok djm@

upgrade to OpenSSH 3.9

upgrade to OpenSSH 3.9

more s/illegal/invalid/

s/Illegal user/Invalid user/; many requests; ok djm, millert, niklas, miod, ...

Add MaxAuthTries sshd config option; ok markus@

improve some code lint did not like; djm millert ok

make two tiny header files go away; djm ok

upgrade to OpenSSH 3.8upgrade to OpenSSH 3.8upgrade to OpenSSH 3.8

upgrade to OpenSSH 3.8

unexpand and delete whitespace at EOL; ok markus@

replace fatal_cleanup() and linked list of fatal callbacks with static
cleanup_exit() function.  re-refine cleanup_exit() where appropriate,
allocate sshd's authctxt eary to allow simpler cleanup in sshd.
tested by many, ok deraadt@

upgrade to OpenSSH 3.7

upgrade to OpenSSH 3.7

fix passwd auth for 'username leaks via timing'; with djm@, original patches from solar

deprecate VerifyReverseMapping since it's dangerous if combined
with IP based access control as noted by Mike Harding; replace with
a UseDNS option, UseDNS is on by default and includes the
VerifyReverseMapping check; with itojun@, provos@, jakob@ and deraadt@
ok deraadt@, djm@

rename log() into logit() to avoid name conflict.  markus ok, from netbsd

Merge OpenSSH 3.6.1

Update to OpenSSH 3.6

don't compare against pw_home if realpath fails for pw_home (seen on AFS); ok djm@

Update to OpenSSH 3.5

Update to OpenSSH 3.5

log illegal user here for missing privsep case (ssh2).
this is executed in the monitor. ok markus@

typo in comment

Pull in OpenSSH-3.4

Upgrade to OpenSSH 3.2.3.

Except for improbable compilation error fixes, this should be the last
commit made to the 2.9-STABLE branche. Have fun upgrading.

That long-delayed OpenSSH 3.2.3 update.

Update to OpenSSH-3.2.3

Update to OpenSSH-3.2.2

Fix typo/thinko.  Pass in as to auth_approval(), not NULL.
Closes PR 2659.

Update OpenSSH to version 3.2.2.

move the packet_send_debug handling from auth-options.c to auth.c; ok provos@

check for NULL; from provos@

make getpwnamallow() allways call pwcopy()

KNF whitespace

move auth_approval into getpwnamallow with help from millert@

getpwnamallow returns struct passwd * only if user valid; okay markus@

fix file type checking (use S_ISREG).  ok by markus

Merge OpenSSH 3.1, keeping /etc as configuration files directory.
(i.e. OpenSSH 3.1 + openbsd29_3.1.patch)

Merge OpenSSH 3.1.

Update to OpenSSH-3.1 on 3.0-stable branch

undo the 'delay hostname lookup' change
match.c must not use compress.c (via canonhost.c/packet.c)
thanks to wilfried@

log user not allowed details, from dwd@bell-labs.com; ok markus@

delay hostname lookup until we see a ``@'' in DenyUsers and AllowUsers
for sshd -u0; ok markus@

s/ReverseMappingCheck/VerifyReverseMapping/ and avoid confusion; ok stevesk@

basic KNF done while i was looking for something else

enum/int type cleanup where it made sense to do so; ok markus@

Merge OpenSSH 3.0.1.

Merge OpenSSH 3.0.1.

This is likely to be the last commit to the 2.8-STABLE branch.

Merge OpenSSH 3.0

Merge OpenSSH 3.0

Pull in patches from current (Errata 002):
Update to OpenSSH-3.0.1 via errata patch (Instead of using release tarball)

don't print ROOT in CAPS for the authentication messages, i.e.
	Accepted publickey for ROOT from 127.0.0.1 port 42734 ssh2
becomes
	Accepted publickey for root from 127.0.0.1 port 42734 ssh2

use realpath() for homedir, too. from jinmei@isl.rdc.toshiba.co.jp

Pull in OpenSSH-2.9.9

Pull in OpenSSH 2.9.9 to the 2.8 branch.

no need to call dirname(pw->pw_dir).
note that dirname(3) modifies its argument on some systems.

tridge@samba.org

terminate secure_filename checking after checking homedir.  that way it
works on AFS.  okay markus@

*known_hosts2 is obsolete for hostbased authentication and
only used for backward compat. merge ssh1/2 hostkey check
and move it to auth.c

fix comment; from jakob@

configurable authorized_keys{,2} location; originally from peter@; ok djm@

Pull in OpenSSH-2.9 to 2.8 branch.

Pull in OpenSSH-2.5.2 for 2.8 branch.

Pull in OpenSSH-2.5.2 for 2.7 branch.

undo /etc/shell and proto 2,1 change for openssh-2.5.2

check /etc/shells, too

OpenSSH-2.5.1 for 2.7 patch branch

make copyright lines the same format

use pwcopy in ssh.c, too

Pull in OpenSSH-2.5.1

Pull in OpenSSH 2.5.0

PermitRootLogin={yes,without-password,forced-commands-only,no}
(before this change, root could login even if PermitRootLogin==no)

unexpand and remove end-of-line whitespace; ok markus@

make ReverseMappingCheck optional in sshd_config; ok djm@,dugsong@

split ssh.h and try to cleanup the #include mess. remove unnecessary #includes.
rename util.[ch] -> misc.[ch]

1) removes fake skey from sshd, since this will be much
   harder with /usr/libexec/auth/login_XXX
2) share/unify code used in ssh-1 and ssh-2 authentication (server side)
3) make addition of BSD_AUTH and other challenge reponse methods
   easier.

support supplementary group in {Allow,Deny}Groups
from stevesk@pobox.com

openssh-2.3.0 (again) for 2.7 branch

new cipher framework

some more Copyright fixes

cleanup copyright notices on all files.  I have attempted to be accurate with
the details.  everything is now under Tatu's licence (which I copied from his
readme), and/or the core-sdi bsd-ish thing for deattack, or various openbsd
developers under a 2-term bsd licence.  We're not changing any rules, just
being accurate.

Pull in the rest of openssh-2.2.0 to 2.7 branch (luvin' cvs...)

unused

lovin' CVS... update patch branch to OpenSSH-2.1.1

accept an empty shell in authentication; bug reported by chris@tinker.ucr.edu

split auth/sshconnect in one file per protocol version

add DSA pubkey auth and other SSH2 fixes.  use ssh-keygen -[xX]
for trading keys with the real and the original SSH, directly from the
people who invented the SSH protocol.

whitespace cleanup

check payload for (illegal) extra data

ssh2 server side, see README.openssh2; enable with 'sshd -2'

split sshd.c -> auth.c session.c sshd.c plus cleanup and goto-removal