Fabio Erculiani
886c4b93ea
/etc/init.d/sshd now sources /sbin/sshd-functions.sh, which contains checkconfig() and gen_key*() friends. This makes possible to reuse that code in the systemd sshd service unit and properly setup host keys the same way the openrc script does.
128 lines
4.4 KiB
Diff
128 lines
4.4 KiB
Diff
http://bugs.gentoo.org/165444
|
|
https://bugzilla.mindrot.org/show_bug.cgi?id=1008
|
|
|
|
Index: readconf.c
|
|
===================================================================
|
|
RCS file: /cvs/openssh/readconf.c,v
|
|
retrieving revision 1.135
|
|
diff -u -r1.135 readconf.c
|
|
--- readconf.c 5 Aug 2006 02:39:40 -0000 1.135
|
|
+++ readconf.c 19 Aug 2006 11:59:52 -0000
|
|
@@ -126,6 +126,7 @@
|
|
oClearAllForwardings, oNoHostAuthenticationForLocalhost,
|
|
oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
|
|
oAddressFamily, oGssAuthentication, oGssDelegateCreds,
|
|
+ oGssTrustDns,
|
|
oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
|
|
oSendEnv, oControlPath, oControlMaster, oHashKnownHosts,
|
|
oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand,
|
|
@@ -163,9 +164,11 @@
|
|
#if defined(GSSAPI)
|
|
{ "gssapiauthentication", oGssAuthentication },
|
|
{ "gssapidelegatecredentials", oGssDelegateCreds },
|
|
+ { "gssapitrustdns", oGssTrustDns },
|
|
#else
|
|
{ "gssapiauthentication", oUnsupported },
|
|
{ "gssapidelegatecredentials", oUnsupported },
|
|
+ { "gssapitrustdns", oUnsupported },
|
|
#endif
|
|
{ "fallbacktorsh", oDeprecated },
|
|
{ "usersh", oDeprecated },
|
|
@@ -444,6 +447,10 @@
|
|
intptr = &options->gss_deleg_creds;
|
|
goto parse_flag;
|
|
|
|
+ case oGssTrustDns:
|
|
+ intptr = &options->gss_trust_dns;
|
|
+ goto parse_flag;
|
|
+
|
|
case oBatchMode:
|
|
intptr = &options->batch_mode;
|
|
goto parse_flag;
|
|
@@ -1010,6 +1017,7 @@
|
|
options->challenge_response_authentication = -1;
|
|
options->gss_authentication = -1;
|
|
options->gss_deleg_creds = -1;
|
|
+ options->gss_trust_dns = -1;
|
|
options->password_authentication = -1;
|
|
options->kbd_interactive_authentication = -1;
|
|
options->kbd_interactive_devices = NULL;
|
|
@@ -1100,6 +1108,8 @@
|
|
options->gss_authentication = 0;
|
|
if (options->gss_deleg_creds == -1)
|
|
options->gss_deleg_creds = 0;
|
|
+ if (options->gss_trust_dns == -1)
|
|
+ options->gss_trust_dns = 0;
|
|
if (options->password_authentication == -1)
|
|
options->password_authentication = 1;
|
|
if (options->kbd_interactive_authentication == -1)
|
|
Index: readconf.h
|
|
===================================================================
|
|
RCS file: /cvs/openssh/readconf.h,v
|
|
retrieving revision 1.63
|
|
diff -u -r1.63 readconf.h
|
|
--- readconf.h 5 Aug 2006 02:39:40 -0000 1.63
|
|
+++ readconf.h 19 Aug 2006 11:59:52 -0000
|
|
@@ -45,6 +45,7 @@
|
|
/* Try S/Key or TIS, authentication. */
|
|
int gss_authentication; /* Try GSS authentication */
|
|
int gss_deleg_creds; /* Delegate GSS credentials */
|
|
+ int gss_trust_dns; /* Trust DNS for GSS canonicalization */
|
|
int password_authentication; /* Try password
|
|
* authentication. */
|
|
int kbd_interactive_authentication; /* Try keyboard-interactive auth. */
|
|
Index: ssh_config.5
|
|
===================================================================
|
|
RCS file: /cvs/openssh/ssh_config.5,v
|
|
retrieving revision 1.97
|
|
diff -u -r1.97 ssh_config.5
|
|
--- ssh_config.5 5 Aug 2006 01:34:51 -0000 1.97
|
|
+++ ssh_config.5 19 Aug 2006 11:59:53 -0000
|
|
@@ -483,7 +483,16 @@
|
|
Forward (delegate) credentials to the server.
|
|
The default is
|
|
.Dq no .
|
|
-Note that this option applies to protocol version 2 only.
|
|
+Note that this option applies to protocol version 2 connections using GSSAPI.
|
|
+.It Cm GSSAPITrustDns
|
|
+Set to
|
|
+.Dq yes to indicate that the DNS is trusted to securely canonicalize
|
|
+the name of the host being connected to. If
|
|
+.Dq no, the hostname entered on the
|
|
+command line will be passed untouched to the GSSAPI library.
|
|
+The default is
|
|
+.Dq no .
|
|
+This option only applies to protocol version 2 connections using GSSAPI.
|
|
.It Cm HashKnownHosts
|
|
Indicates that
|
|
.Xr ssh 1
|
|
Index: sshconnect2.c
|
|
===================================================================
|
|
RCS file: /cvs/openssh/sshconnect2.c,v
|
|
retrieving revision 1.151
|
|
diff -u -r1.151 sshconnect2.c
|
|
--- sshconnect2.c 18 Aug 2006 14:33:34 -0000 1.151
|
|
+++ sshconnect2.c 19 Aug 2006 11:59:53 -0000
|
|
@@ -499,6 +499,12 @@
|
|
static u_int mech = 0;
|
|
OM_uint32 min;
|
|
int ok = 0;
|
|
+ const char *gss_host;
|
|
+
|
|
+ if (options.gss_trust_dns)
|
|
+ gss_host = get_canonical_hostname(1);
|
|
+ else
|
|
+ gss_host = authctxt->host;
|
|
|
|
/* Try one GSSAPI method at a time, rather than sending them all at
|
|
* once. */
|
|
@@ -511,7 +517,7 @@
|
|
/* My DER encoding requires length<128 */
|
|
if (gss_supported->elements[mech].length < 128 &&
|
|
ssh_gssapi_check_mechanism(&gssctxt,
|
|
- &gss_supported->elements[mech], authctxt->host)) {
|
|
+ &gss_supported->elements[mech], gss_host)) {
|
|
ok = 1; /* Mechanism works */
|
|
} else {
|
|
mech++;
|