CVS log for src/usr.bin/ssh/servconf.h

Up to [OpenBSD] / src / usr.bin / ssh

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

allow ssh and sshd to set arbitrary TOS/DSCP/QoS values instead of
hardcoding lowdelay/throughput.

bz#1733 patch from philipp AT redfish-solutions.com; ok markus@ deraadt@

add a KexAlgorithms knob to the client and server configuration to allow
selection of which key exchange methods are used by ssh(1) and sshd(8)
and their order of preference.

ok markus@

add some optional indirection to matching of principal names listed
in certificates. Currently, a certificate must include the a user's name
to be accepted for authentication. This change adds the ability to
specify a list of certificate principal names that are acceptable.

When authenticating using a CA trusted through ~/.ssh/authorized_keys,
this adds a new principals="name1[,name2,...]" key option.

For CAs listed through sshd_config's TrustedCAKeys option, a new config
option "AuthorizedPrincipalsFile" specifies a per-user file containing
the list of acceptable names.

If either option is absent, the current behaviour of requiring the
username to appear in principals continues to apply.

These options are useful for role accounts, disjoint account namespaces
and "user@realm"-style naming policies in certificates.

feedback and ok markus@

Add a TrustedUserCAKeys option to sshd_config to specify CA keys that
are trusted to authenticate users (in addition than doing it per-user
in authorized_keys).

Add a RevokedKeys option to sshd_config and a @revoked marker to
known_hosts to allow keys to me revoked and banned for user or host
authentication.

feedback and ok markus@

Add support for certificate key types for users and hosts.

OpenSSH certificate key types are not X.509 certificates, but a much
simpler format that encodes a public key, identity information and
some validity constraints and signs it with a CA key. CA keys are
regular SSH keys. This certificate style avoids the attack surface
of X.509 certificates and is very easy to deploy.

Certified host keys allow automatic acceptance of new host keys
when a CA certificate is marked as trusted in ~/.ssh/known_hosts.
see VERIFYING HOST KEYS in ssh(1) for details.

Certified user keys allow authentication of users when the signing
CA key is marked as trusted in authorized_keys. See "AUTHORIZED_KEYS
FILE FORMAT" in sshd(8) for details.

Certificates are minted using ssh-keygen(1), documentation is in
the "CERTIFICATES" section of that manpage.

Documentation on the format of certificates is in the file
PROTOCOL.certkeys

feedback and ok markus@

avoid run-time failures when specifying hostkeys via a relative
path by prepending the cwd in these cases; bz#1290; ok dtucker@

Remove RoutingDomain from ssh since it's now not needed.  It can be replaced
with "route exec" or "nc -V" as a proxycommand.  "route exec" also ensures
that trafic such as DNS lookups stays withing the specified routingdomain.

For example (from reyk):
# route -T 2 exec /usr/sbin/sshd
or inherited from the parent process
$ route -T 2 exec sh
$ ssh 10.1.2.3

ok deraadt@ markus@ stevesk@ reyk@

Allow to set the rdomain in ssh/sftp/scp/sshd and ssh-keyscan.

ok markus@

make a2port() return -1 when it encounters an invalid port number
rather than 0, which it will now treat as valid (needed for future work)

adjust current consumers of a2port() to check its return value is <= 0,
which in turn required some things to be converted from u_short => int

make use of int vs. u_short consistent in some other places too

feedback & ok markus@

Add support for an experimental zero-knowledge password authentication
method using the J-PAKE protocol described in F. Hao, P. Ryan,
"Password Authenticated Key Exchange by Juggling", 16th Workshop on
Security Protocols, Cambridge, April 2008.

This method allows password-based authentication without exposing
the password to the server. Instead, the client and server exchange
cryptographic proofs to demonstrate of knowledge of the password while
revealing nothing useful to an attacker or compromised endpoint.

This is experimental, work-in-progress code and is presently
compiled-time disabled (turn on -DJPAKE in Makefile.inc).

"just commit it.  It isn't too intrusive." deraadt@

Add extended test mode (-T) and connection parameters for test mode (-C).
-T causes sshd to write its effective configuration to stdout and exit.
-C causes any relevant Match rules to be applied before output.  The
combination allows tesing of the parser and config files.  ok deraadt djm

Make the maximum number of sessions run-time controllable via
a sshd_config MaxSessions knob. This is useful for disabling
login/shell/subsystem access while leaving port-forwarding working
(MaxSessions 0), disabling connection multiplexing (MaxSessions 1) or
simply increasing the number of allows multiplexed sessions.

Because some bozos are sure to configure MaxSessions in excess of the
number of available file descriptors in sshd (which, at peak, might be
as many as 9*MaxSessions), audit sshd to ensure that it doesn't leak fds
on error paths, and make it fail gracefully on out-of-fd conditions -
sending channel errors instead of than exiting with fatal().

bz#1090; MaxSessions config bits and manpage from junyer AT gmail.com

ok markus@

Enable the AllowAgentForwarding option in sshd_config (global and match
context), to specify if agents should be permitted on the server.
As the man page states:

``Note that disabling Agent forwarding does not improve security
unless users are also denied shell access, as they can always install
their own forwarders.''

ok djm@, ok and a mild frown markus@

rekey arc4random and OpenSSL RNG in postauth child
closefrom fds > 2 before shell/command execution
ok markus@

add sshd_config ChrootDirectory option to chroot(2) users to a directory and
tweak internal sftp server to work with it (no special files in chroot
required). ok markus@

Teach Match how handle config directives that are used before authentication.
This allows configurations such as permitting password authentication from
the local net only while requiring pubkey from offsite.  ok djm@, man page
bits ok jmc@

upgrade to OpenSSH 4.4

upgrade to OpenSSH 4.4

Add ability to match groups to Match keyword in sshd_config.  Feedback djm@,
stevesk@, ok stevesk@.

almost entirely get rid of the culture of ".h files that include .h files"
ok djm, sort of ok stevesk
makes the pain stop in one easy step

Make PermitOpen take a list of permitted ports and act more like most other
keywords (ie the first match is the effective setting).  This also makes it
easier to override a previously set PermitOpen.  ok djm@

Add ForceCommand keyword to sshd_config, equivalent to the "command="
key option, man page entry and example in sshd_config.  Feedback & ok djm@,
man page corrections & ok jmc@

Add support for conditional directives to sshd_config via a "Match" keyword,
which works similarly to the "Host" directive in ssh_config.

Lines after a Match line override the default set in the main section
if the condition on the Match line is true, eg

AllowTcpForwarding yes
Match User anoncvs
        AllowTcpForwarding no

will allow port forwarding by all users except "anoncvs".

Currently only a very small subset of directives are supported.

ok djm@

support arguments to Subsystem commands; ok markus@

standardise spacing in $OpenBSD$ tags; requested by deraadt@

upgrade to OpenSSH 4.3

upgrade to OpenSSH 4.3

Add support for tun(4) forwarding over OpenSSH, based on an idea and
initial channel code bits by markus@. This is a simple and easy way to
use OpenSSH for ad hoc virtual private network connections, e.g.
administrative tunnels or secure wireless access. It's based on a new
ssh channel and works similar to the existing TCP forwarding support,
except that it depends on the tun(4) network interface on both ends of
the connection for layer 2 or layer 3 tunneling. This diff also adds
support for LocalCommand in the ssh(1) client.

ok djm@, markus@, jmc@ (manpages), tested and discussed with others

upgrade to OpenSSH 4.0

upgrade to OpenSSH 4.0

bz #898: support AddressFamily in sshd_config. from peak@argo.troja.mff.cuni.cz
ok deraadt@

upgrade to OpenSSH 3.9

upgrade to OpenSSH 3.9

re-exec sshd on accept(); initial work, final debugging and ok markus@

Add MaxAuthTries sshd config option; ok markus@

bz #815: implement ability to pass specified environment variables from the
client to the server; ok markus@

upgrade to OpenSSH 3.8upgrade to OpenSSH 3.8upgrade to OpenSSH 3.8

upgrade to OpenSSH 3.8

implement KerberosGetAFSToken server option. ok markus@, beck@

rename keepalive to tcpkeepalive; the old name causes too much
confusion; ok djm, dtucker; with help from jmc@

upgrade to OpenSSH 3.7

upgrade to OpenSSH 3.7

remove unused kerberos code; ok henning@

support GSS API user authentication; patches from Simon Wilkinson,
stripped down and tested by Jakob and myself.

remove RhostsAuthentication; suggested by djm@ before; ok djm@, deraadt@,
fgsch@, miod@, henning@, jakob@ and others

remove (already disabled) KRB4/AFS support, re-enable -k in ssh(1);
test+ok henning@

deprecate VerifyReverseMapping since it's dangerous if combined
with IP based access control as noted by Mike Harding; replace with
a UseDNS option, UseDNS is on by default and includes the
VerifyReverseMapping check; with itojun@, provos@, jakob@ and deraadt@
ok deraadt@, djm@

always parse kerberos options. ok djm@ markus@

Update to OpenSSH 3.5

Update to OpenSSH 3.5

add PermitUserEnvironment (off by default!); from dot@dotat.at; ok provos, deraadt

Pull in OpenSSH-3.4

Update OpenSSH to version 3.3 (with local changes, configuration files still
living in /etc and privsep user being nobody).

allow Compression=yes/no in sshd_config

Upgrade to OpenSSH 3.2.3.

Except for improbable compilation error fixes, this should be the last
commit made to the 2.9-STABLE branche. Have fun upgrading.

Update OpenSSH to version 3.2.2.

for unprivileged user, group do:
pw=getpwnam(SSH_PRIVSEP_USER); do_setusercontext(pw).  ok provos@

_PATH_PRIVSEP_CHROOT_DIR; ok provos@

integrate privilege separated openssh; its turned off by default for now.
work done by me and markus@

Merge OpenSSH 3.1, keeping /etc as configuration files directory.
(i.e. OpenSSH 3.1 + openbsd29_3.1.patch)

Merge OpenSSH 3.1.

Update to OpenSSH-3.1 on 3.0-stable branch

$OpenBSD$ and RCSID() cleanup: don't use RCSID() in .h files; add
missing RCSID() to .c files and remove dup /*$OpenBSD$*/ from .c
files.  ok markus@

s/ReverseMappingCheck/VerifyReverseMapping/ and avoid confusion; ok stevesk@

add X11UseLocalhost; ok markus@

basic KNF done while i was looking for something else

add -o to sshd, too. ok deraadt@

Pull in OpenSSH-2.9.9

Pull in OpenSSH 2.9.9 to the 2.8 branch.

typo in comment

deprecate CheckMail. ok markus@
----------------------------------------------------------------------

remove comments from .h, since they are cut&paste from the .c files
and out of sync

Kerberos v5 support for SSH1, mostly from Assar Westerlund <assar@freebsd.org> and Bjorn Gronvall <bg@sics.se>. markus@ ok

prototype pedant.  not very creative...
- () -> (void)
- no variable names

get rid of known_hosts2, use it for hostkey lookup, but do not modify.

configurable authorized_keys{,2} location; originally from peter@; ok djm@

improved kbd-interactive support. work by per@appgate.com and me

Pull in OpenSSH-2.9 to 2.8 branch.

Add options ClientAliveInterval and ClientAliveCountMax to sshd.
This gives the ability to do a "keepalive" via the encrypted channel
which can't be spoofed (unlike TCP keepalives). Useful for when you want
to use ssh connections to authenticate people for something, and know
relatively quickly when they are no longer authenticated. Disabled
by default (of course). ok markus@

implement HostbasedAuthentication (= RhostRSAAuthentication for ssh v2)
similar to RhostRSAAuthentication unless you enable (the experimental)
HostbasedUsesNameFromPacketOnly option.  please test. :)

PrintLastLog option; from chip@valinux.com with some minor
changes by me.  ok markus@

Pull in OpenSSH-2.5.2 for 2.8 branch.

Pull in OpenSSH-2.5.2 for 2.7 branch.

OpenSSH-2.5.1 for 2.7 patch branch

Pull in OpenSSH-2.5.1

Pull in OpenSSH 2.5.0

PermitRootLogin={yes,without-password,forced-commands-only,no}
(before this change, root could login even if PermitRootLogin==no)

1) clean up the MAC support for SSH-2
2) allow you to specify the MAC with 'ssh -m'
3) or the 'MACs' keyword in ssh(d)_config
4) add hmac-{md5,sha1}-96
	ok stevesk@, provos@

make ReverseMappingCheck optional in sshd_config; ok djm@,dugsong@

rename skey -> challenge response.
auto-enable kbd-interactive for ssh2 if challenge-reponse is enabled.

only auth-chall.c needs #ifdef SKEY

implement option 'Banner /etc/issue.net' for ssh2, move version to
2.3.1 (needed for bugcompat detection, 2.3.0 would fail if Banner
is enabled).

replace 'unsigned bla' with 'u_bla' everywhere. also, replace 'char unsigned'
with u_char.

add support for RSA to SSH2.  please test.

there are now 3 types of keys: RSA1 is used by ssh-1 only,
RSA and DSA are used by SSH2.

you can use 'ssh-keygen -t rsa -f ssh2_rsa_file' to generate RSA
keys for SSH2 and use the RSA keys for hostkeys or for user keys.

SSH2 RSA or DSA keys are added to .ssh/authorised_keys2 as before.

IdentityFile2, HostDsaKey and DSAAuthentication are obsolete.
you can use multiple IdentityFile and HostKey for all types of keys.

the option DSAAuthentication is replaced by PubkeyAuthetication.

openssh-2.3.0 (again) for 2.7 branch

AllowTcpForwarding; from naddy@

add support for s/key (kbd-interactive) to ssh2, based on work by mkiernan@avantgo.com and me

cleanup copyright notices on all files.  I have attempted to be accurate with
the details.  everything is now under Tatu's licence (which I copied from his
readme), and/or the core-sdi bsd-ish thing for deattack, or various openbsd
developers under a 2-term bsd licence.  We're not changing any rules, just
being accurate.

Pull in the rest of openssh-2.2.0 to 2.7 branch (luvin' cvs...)

random early drop; ok theo, niels

MaxStartups: limit number of unauthenticated connections, work by theo and me

OpenBSD tag

add support for ssh v2 subsystems. ok markus@.

lovin' CVS... update patch branch to OpenSSH-2.1.1

xauth_location support; pr 1234

add DSAAuthetication option to ssh/sshd, document SSH2 in sshd.8

GatewayPorts for sshd, ok deraadt@

s/DsaKey/HostDSAKey/, document option

PidFile, pr 1210

whitespace cleanup

add Cipher and Protocol options to ssh/sshd, e.g.:
ssh -o 'Protocol 1,2' if you prefer proto 1, ssh -o 'Ciphers arcfour,3des-cbc'

ssh2 server side, see README.openssh2; enable with 'sshd -2'

ipv6 support: mostly gethostbyname->getaddrinfo/getnameinfo, new features:
sshd allows multiple ListenAddress and Port options.  note that libwrap is
not IPv6-ready. (based on patches from <kick@kyoto.wide.ad.jp> and
fujiwara@rcac.tdi.co.jp)

KNF, final part 3

much more KNF

IgnoreUserKnownHosts(default=no), used for RhostRSAAuth, ok deraadt,millert

add LogLevel {QUIET, FATAL, ERROR, INFO, CHAT, DEBUG} to ssh/sshd,
obsoletes QuietMode and FascistLogging in sshd.

remove AllowHosts, DenyHosts, SilentDeny server access control cruft - replace with LIBWRAP moved to child. ok markus@ deraat@

SilentDeny, don't log/answer refused connections, deraadt@

Allow/Deny Users/Groups, from zzlevo@dd.chalmers.se, ok deraadt@

UseLogin, default=no, from kpa@gmx.net, ok deraadt@

You have Mail. Email fuer Dich. Karsten Patzwaldt <kpa@gmx.net> default=no

add skey to sshd:

1) pass *pw to auth_password() not user_name, do_authentication already
   keeps private copy of struct passwd for current user.
2) limit authentication attemps to 5, otherwise
        ssh -o 'NumberOfPasswordPrompts 100000' host
   lets you enter 100000 passwds
3) make s/key a run-time option in /etc/sshd_config
4) generate fake skeys,
   for s/key for nonexisting users, too
   limit auth-tries for nonexisting users, too.
Note that
% ssh -l nonexisting-user -o 'NumberOfPasswordPrompts 100000' host
has NO limits in ssh-1.2.27

get rid of references to randomseedfile we dont need it.  for sshd
just spit out a warning that the configuration option is obsolete.

update krb4/AFS support to ssh-1.2.27-afs-kerberos-pl1 level, clean up unused variables, update manpages

X11DisplayOffset; aaron

i bet a lot of people didn't know what ssh 1.2.16 had a nice license.
well, except for the patent issues.  someone in sweden (forget their
name at the moment) cleaned out most of the patented code, and now
this code removes rsa code.  when this is done, it will link against
libssl, but the work isn't completely done yet.  then we need to bring
this up to modern days, featurewise.