rpms/openssh
3
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

bump version to 5.3p1

Browse Source
This commit is contained in:
Jan F. Chadima 2009-11-20 17:01:48 +00:00
parent 22f8c10386
commit 1c90146a07
15 changed files with 3851 additions and 291 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
openssh-3.8.1p1-krb5-config.patch
View File

@ -1,16 +0,0 @@
Search the path for krb5-config if the prefix wasn't specified.
--- openssh-3.8p1/configure.ac 2004-02-26 21:17:12.000000000 -0500
+++ openssh-3.8p1/configure.ac 2004-02-26 21:17:06.000000000 -0500
@@ -2077,8 +2077,10 @@
KRB5_MSG="yes"
AC_MSG_CHECKING(for krb5-config)
- if test -x $KRB5ROOT/bin/krb5-config ; then
- KRB5CONF=$KRB5ROOT/bin/krb5-config
+ AC_PATH_PROG([KRB5CONF],[krb5-config],
+ [$KRB5ROOT/bin/krb5-config],
+ [$KRB5ROOT/bin:$PATH])
+ if test -x $KRB5CONF ; then
AC_MSG_RESULT($KRB5CONF)
AC_MSG_CHECKING(for gssapi support)

28
openssh-5.1p1-skip-initial.patch
View File

@ -1,28 +0,0 @@
Skip the initial empty-password check if permit_empty_passwd is disabled. This
doesn't change the timing profiles of the host because the additional condition
check which can short-circuit the call to pam_authenticate() has no dependency
on the identity of the user who is being authenticated.
diff -up openssh-5.1p1/auth1.c.skip-initial openssh-5.1p1/auth1.c
--- openssh-5.1p1/auth1.c.skip-initial 2008-07-09 12:54:05.000000000 +0200
+++ openssh-5.1p1/auth1.c 2008-07-23 18:26:01.000000000 +0200
@@ -244,7 +244,7 @@ do_authloop(Authctxt *authctxt)
authctxt->valid ? "" : "invalid user ", authctxt->user);
/* If the user has no password, accept authentication immediately. */
- if (options.password_authentication &&
+ if (options.permit_empty_passwd && options.password_authentication &&
#ifdef KRB5
(!options.kerberos_authentication || options.kerberos_or_local_passwd) &&
#endif
diff -up openssh-5.1p1/auth2-none.c.skip-initial openssh-5.1p1/auth2-none.c
--- openssh-5.1p1/auth2-none.c.skip-initial 2008-07-02 14:56:09.000000000 +0200
+++ openssh-5.1p1/auth2-none.c 2008-07-23 18:26:01.000000000 +0200
@@ -65,7 +65,7 @@ userauth_none(Authctxt *authctxt)
if (check_nt_auth(1, authctxt->pw) == 0)
return (0);
#endif
- if (options.password_authentication)
+ if (options.permit_empty_passwd && options.password_authentication)
return (PRIVSEP(auth_password(authctxt, "")));
return (0);
}

47
openssh-5.2p1-pathmax.patch
View File

@ -1,47 +0,0 @@
diff -up openssh-5.2p1/ssh.c.pathmax openssh-5.2p1/ssh.c
--- openssh-5.2p1/ssh.c.pathmax 2009-07-08 14:23:19.000000000 +0200
+++ openssh-5.2p1/ssh.c 2009-07-08 14:26:26.000000000 +0200
@@ -49,6 +49,7 @@
#include <sys/resource.h>
#include <sys/ioctl.h>
#include <sys/socket.h>
+#include <sys/param.h>
#include <ctype.h>
#include <errno.h>
@@ -208,8 +209,8 @@ void muxserver_listen(void);
int
main(int ac, char **av)
{
- int i, opt, exit_status, use_syslog;
- char *p, *cp, *line, buf[256];
+ int i, r, opt, exit_status, use_syslog;
+ char *p, *cp, *line, buf[MAXPATHLEN];
struct stat st;
struct passwd *pw;
int dummy, timeout_ms;
@@ -624,9 +625,10 @@ main(int ac, char **av)
fatal("Can't open user config file %.100s: "
"%.100s", config, strerror(errno));
} else {
- snprintf(buf, sizeof buf, "%.100s/%.100s", pw->pw_dir,
+ r = snprintf(buf, sizeof buf, "%s/%s", pw->pw_dir,
_PATH_SSH_USER_CONFFILE);
- (void)read_config_file(buf, host, &options, 1);
+ if (r > 0 && (size_t)r < sizeof(buf))
+ (void)read_config_file(buf, host, &options, 1);
/* Read systemwide configuration file after use config. */
(void)read_config_file(_PATH_HOST_CONFIG_FILE, host,
@@ -787,9 +789,9 @@ main(int ac, char **av)
* Now that we are back to our own permissions, create ~/.ssh
* directory if it doesn't already exist.
*/
- snprintf(buf, sizeof buf, "%.100s%s%.100s", pw->pw_dir,
+ r = snprintf(buf, sizeof buf, "%s%s%s", pw->pw_dir,
strcmp(pw->pw_dir, "/") ? "/" : "", _PATH_SSH_USER_DIR);
- if (stat(buf, &st) < 0)
+ if (r > 0 && (size_t)r < sizeof(buf) && stat(buf, &st) < 0)
if (mkdir(buf, 0700) < 0)
error("Could not create directory '%.200s'.", buf);

72
openssh-4.7p1-audit.patch → openssh-5.3p1-audit.patch
View File

@ -1,6 +1,6 @@
diff -up openssh-5.2p1/auth.c.audit openssh-5.2p1/auth.c
--- openssh-5.2p1/auth.c.audit 2008-11-05 06:12:54.000000000 +0100
+++ openssh-5.2p1/auth.c 2009-08-09 09:22:23.634850536 +0200
diff -up openssh-5.3p1/auth.c.audit openssh-5.3p1/auth.c
--- openssh-5.3p1/auth.c.audit 2008-11-05 06:12:54.000000000 +0100
+++ openssh-5.3p1/auth.c 2009-10-11 13:02:47.000000000 +0200
@@ -287,6 +287,12 @@ auth_log(Authctxt *authctxt, int authent
get_canonical_hostname(options.use_dns), "ssh", &loginmsg);
# endif
@ -25,19 +25,10 @@ diff -up openssh-5.2p1/auth.c.audit openssh-5.2p1/auth.c
#ifdef SSH_AUDIT_EVENTS
audit_event(SSH_INVALID_USER);
#endif /* SSH_AUDIT_EVENTS */
diff -up openssh-5.2p1/config.h.in.audit openssh-5.2p1/config.h.in
--- openssh-5.2p1/config.h.in.audit 2009-02-23 01:18:12.000000000 +0100
+++ openssh-5.2p1/config.h.in 2009-08-09 09:22:28.825939998 +0200
@@ -1,5 +1,8 @@
/* config.h.in. Generated from configure.ac by autoheader. */
+/* Define if building universal (internal helper macro) */
+#undef AC_APPLE_UNIVERSAL_BUILD
+
/* Define if you have a getaddrinfo that fails for the all-zeros IPv6 address
*/
#undef AIX_GETNAMEINFO_HACK
@@ -521,6 +524,9 @@
diff -up openssh-5.3p1/config.h.in.audit openssh-5.3p1/config.h.in
--- openssh-5.3p1/config.h.in.audit 2009-09-26 08:31:14.000000000 +0200
+++ openssh-5.3p1/config.h.in 2009-10-11 13:09:41.000000000 +0200
@@ -533,6 +533,9 @@
/* Define to 1 if you have the <lastlog.h> header file. */
#undef HAVE_LASTLOG_H
@ -47,7 +38,7 @@ diff -up openssh-5.2p1/config.h.in.audit openssh-5.2p1/config.h.in
/* Define to 1 if you have the `bsm' library (-lbsm). */
#undef HAVE_LIBBSM
@@ -560,6 +566,9 @@
@@ -572,6 +575,9 @@
/* Define to 1 if you have the <limits.h> header file. */
#undef HAVE_LIMITS_H
@ -57,7 +48,7 @@ diff -up openssh-5.2p1/config.h.in.audit openssh-5.2p1/config.h.in
/* Define to 1 if you have the <linux/if_tun.h> header file. */
#undef HAVE_LINUX_IF_TUN_H
@@ -756,6 +765,9 @@
@@ -768,6 +774,9 @@
/* Define to 1 if you have the `setgroups' function. */
#undef HAVE_SETGROUPS
@ -67,7 +58,7 @@ diff -up openssh-5.2p1/config.h.in.audit openssh-5.2p1/config.h.in
/* Define to 1 if you have the `setlogin' function. */
#undef HAVE_SETLOGIN
@@ -1330,6 +1342,10 @@
@@ -1348,6 +1357,10 @@
/* Prepend the address family to IP tunnel traffic */
#undef SSH_TUN_PREPEND_AF
@ -78,31 +69,10 @@ diff -up openssh-5.2p1/config.h.in.audit openssh-5.2p1/config.h.in
/* Define to 1 if you have the ANSI C header files. */
#undef STDC_HEADERS
@@ -1397,9 +1413,17 @@
/* Define if you want SELinux support. */
#undef WITH_SELINUX
-/* Define to 1 if your processor stores words with the most significant byte
- first (like Motorola and SPARC, unlike Intel and VAX). */
-#undef WORDS_BIGENDIAN
+/* Define WORDS_BIGENDIAN to 1 if your processor stores words with the most
+ significant byte first (like Motorola and SPARC, unlike Intel). */
+#if defined AC_APPLE_UNIVERSAL_BUILD
+# if defined __BIG_ENDIAN__
+# define WORDS_BIGENDIAN 1
+# endif
+#else
+# ifndef WORDS_BIGENDIAN
+# undef WORDS_BIGENDIAN
+# endif
+#endif
/* Define if xauth is found in your path */
#undef XAUTH_PATH
diff -up openssh-5.2p1/configure.ac.audit openssh-5.2p1/configure.ac
--- openssh-5.2p1/configure.ac.audit 2009-08-09 09:22:23.608877833 +0200
+++ openssh-5.2p1/configure.ac 2009-08-09 09:22:23.646244409 +0200
@@ -3342,6 +3342,18 @@ AC_ARG_WITH(selinux,
diff -up openssh-5.3p1/configure.ac.audit openssh-5.3p1/configure.ac
--- openssh-5.3p1/configure.ac.audit 2009-09-11 06:56:08.000000000 +0200
+++ openssh-5.3p1/configure.ac 2009-10-11 13:08:03.000000000 +0200
@@ -3407,6 +3407,18 @@ AC_ARG_WITH(selinux,
fi ]
)
@ -121,7 +91,7 @@ diff -up openssh-5.2p1/configure.ac.audit openssh-5.2p1/configure.ac
# Check whether user wants Kerberos 5 support
KRB5_MSG="no"
AC_ARG_WITH(kerberos5,
@@ -4170,6 +4182,7 @@ echo " PAM support
@@ -4226,6 +4238,7 @@ echo " PAM support
echo " OSF SIA support: $SIA_MSG"
echo " KerberosV support: $KRB5_MSG"
echo " SELinux support: $SELINUX_MSG"
@ -129,9 +99,9 @@ diff -up openssh-5.2p1/configure.ac.audit openssh-5.2p1/configure.ac
echo " Smartcard support: $SCARD_MSG"
echo " S/KEY support: $SKEY_MSG"
echo " TCP Wrappers support: $TCPW_MSG"
diff -up openssh-5.2p1/loginrec.c.audit openssh-5.2p1/loginrec.c
--- openssh-5.2p1/loginrec.c.audit 2009-02-12 03:12:22.000000000 +0100
+++ openssh-5.2p1/loginrec.c 2009-08-09 09:22:23.667199702 +0200
diff -up openssh-5.3p1/loginrec.c.audit openssh-5.3p1/loginrec.c
--- openssh-5.3p1/loginrec.c.audit 2009-02-12 03:12:22.000000000 +0100
+++ openssh-5.3p1/loginrec.c 2009-10-11 13:06:16.000000000 +0200
@@ -176,6 +176,10 @@
#include "auth.h"
#include "buffer.h"
@ -252,9 +222,9 @@ diff -up openssh-5.2p1/loginrec.c.audit openssh-5.2p1/loginrec.c
/**
** Low-level libutil login() functions
**/
diff -up openssh-5.2p1/loginrec.h.audit openssh-5.2p1/loginrec.h
--- openssh-5.2p1/loginrec.h.audit 2006-08-05 04:39:40.000000000 +0200
+++ openssh-5.2p1/loginrec.h 2009-08-09 09:22:23.641175349 +0200
diff -up openssh-5.3p1/loginrec.h.audit openssh-5.3p1/loginrec.h
--- openssh-5.3p1/loginrec.h.audit 2006-08-05 04:39:40.000000000 +0200
+++ openssh-5.3p1/loginrec.h 2009-10-11 13:04:28.000000000 +0200
@@ -127,5 +127,9 @@ char *line_stripname(char *dst, const ch
char *line_abbrevname(char *dst, const char *src, int dstsize);

162
openssh-5.2p1-fips.patch → openssh-5.3p1-fips.patch
View File

@ -1,6 +1,6 @@
diff -up openssh-5.2p1/auth2-pubkey.c.fips openssh-5.2p1/auth2-pubkey.c
--- openssh-5.2p1/auth2-pubkey.c.fips 2009-05-15 15:51:01.000000000 +0200
+++ openssh-5.2p1/auth2-pubkey.c 2009-05-15 15:51:01.000000000 +0200
diff -up openssh-5.3p1/auth2-pubkey.c.fips openssh-5.3p1/auth2-pubkey.c
--- openssh-5.3p1/auth2-pubkey.c.fips 2009-10-02 14:12:00.000000000 +0200
+++ openssh-5.3p1/auth2-pubkey.c 2009-10-02 14:12:00.000000000 +0200
@@ -33,6 +33,7 @@
#include <stdio.h>
#include <stdarg.h>
@ -9,7 +9,7 @@ diff -up openssh-5.2p1/auth2-pubkey.c.fips openssh-5.2p1/auth2-pubkey.c
#include "xmalloc.h"
#include "ssh.h"
@@ -243,7 +244,7 @@ user_key_allowed2(struct passwd *pw, Key
@@ -240,7 +241,7 @@ user_key_allowed2(struct passwd *pw, Key
found_key = 1;
debug("matching key found: file %s, line %lu",
file, linenum);
@ -18,9 +18,9 @@ diff -up openssh-5.2p1/auth2-pubkey.c.fips openssh-5.2p1/auth2-pubkey.c
verbose("Found matching %s key: %s",
key_type(found), fp);
xfree(fp);
diff -up openssh-5.2p1/authfile.c.fips openssh-5.2p1/authfile.c
--- openssh-5.2p1/authfile.c.fips 2006-09-01 07:38:36.000000000 +0200
+++ openssh-5.2p1/authfile.c 2009-05-15 16:08:34.000000000 +0200
diff -up openssh-5.3p1/authfile.c.fips openssh-5.3p1/authfile.c
--- openssh-5.3p1/authfile.c.fips 2006-09-01 07:38:36.000000000 +0200
+++ openssh-5.3p1/authfile.c 2009-10-02 14:12:00.000000000 +0200
@@ -143,8 +143,14 @@ key_save_private_rsa1(Key *key, const ch
/* Allocate space for the private part of the key in the buffer. */
cp = buffer_append_space(&encrypted, buffer_len(&buffer));
@ -55,9 +55,9 @@ diff -up openssh-5.2p1/authfile.c.fips openssh-5.2p1/authfile.c
cipher_crypt(&ciphercontext, cp,
buffer_ptr(&buffer), buffer_len(&buffer));
cipher_cleanup(&ciphercontext);
diff -up openssh-5.2p1/cipher.c.fips openssh-5.2p1/cipher.c
--- openssh-5.2p1/cipher.c.fips 2009-03-06 18:23:21.000000000 +0100
+++ openssh-5.2p1/cipher.c 2009-05-15 16:14:16.000000000 +0200
diff -up openssh-5.3p1/cipher.c.fips openssh-5.3p1/cipher.c
--- openssh-5.3p1/cipher.c.fips 2009-10-02 13:44:03.000000000 +0200
+++ openssh-5.3p1/cipher.c 2009-10-02 14:12:00.000000000 +0200
@@ -40,6 +40,7 @@
#include <sys/types.h>
@ -142,9 +142,9 @@ diff -up openssh-5.2p1/cipher.c.fips openssh-5.2p1/cipher.c
}
/*
diff -up openssh-5.2p1/cipher-ctr.c.fips openssh-5.2p1/cipher-ctr.c
--- openssh-5.2p1/cipher-ctr.c.fips 2007-06-14 15:21:33.000000000 +0200
+++ openssh-5.2p1/cipher-ctr.c 2009-05-15 15:51:01.000000000 +0200
diff -up openssh-5.3p1/cipher-ctr.c.fips openssh-5.3p1/cipher-ctr.c
--- openssh-5.3p1/cipher-ctr.c.fips 2007-06-14 15:21:33.000000000 +0200
+++ openssh-5.3p1/cipher-ctr.c 2009-10-02 14:12:00.000000000 +0200
@@ -140,7 +140,8 @@ evp_aes_128_ctr(void)
aes_ctr.do_cipher = ssh_aes_ctr;
#ifndef SSH_OLD_EVP
@ -155,9 +155,9 @@ diff -up openssh-5.2p1/cipher-ctr.c.fips openssh-5.2p1/cipher-ctr.c
#endif
return (&aes_ctr);
}
diff -up openssh-5.2p1/cipher.h.fips openssh-5.2p1/cipher.h
--- openssh-5.2p1/cipher.h.fips 2009-01-28 06:38:41.000000000 +0100
+++ openssh-5.2p1/cipher.h 2009-05-15 15:51:01.000000000 +0200
diff -up openssh-5.3p1/cipher.h.fips openssh-5.3p1/cipher.h
--- openssh-5.3p1/cipher.h.fips 2009-01-28 06:38:41.000000000 +0100
+++ openssh-5.3p1/cipher.h 2009-10-02 14:12:00.000000000 +0200
@@ -78,7 +78,7 @@ void cipher_init(CipherContext *, Ciphe
const u_char *, u_int, int);
void cipher_crypt(CipherContext *, u_char *, const u_char *, u_int);
@ -167,9 +167,9 @@ diff -up openssh-5.2p1/cipher.h.fips openssh-5.2p1/cipher.h
u_int cipher_blocksize(const Cipher *);
u_int cipher_keylen(const Cipher *);
u_int cipher_is_cbc(const Cipher *);
diff -up openssh-5.2p1/mac.c.fips openssh-5.2p1/mac.c
--- openssh-5.2p1/mac.c.fips 2008-06-13 02:58:50.000000000 +0200
+++ openssh-5.2p1/mac.c 2009-05-15 15:51:01.000000000 +0200
diff -up openssh-5.3p1/mac.c.fips openssh-5.3p1/mac.c
--- openssh-5.3p1/mac.c.fips 2008-06-13 02:58:50.000000000 +0200
+++ openssh-5.3p1/mac.c 2009-10-02 14:12:00.000000000 +0200
@@ -28,6 +28,7 @@
#include <sys/types.h>
@ -219,10 +219,10 @@ diff -up openssh-5.2p1/mac.c.fips openssh-5.2p1/mac.c
for (i = 0; macs[i].name; i++) {
if (strcmp(name, macs[i].name) == 0) {
diff -up openssh-5.2p1/Makefile.in.fips openssh-5.2p1/Makefile.in
--- openssh-5.2p1/Makefile.in.fips 2009-05-15 15:51:01.000000000 +0200
+++ openssh-5.2p1/Makefile.in 2009-05-15 15:51:01.000000000 +0200
@@ -134,28 +134,28 @@ libssh.a: $(LIBSSH_OBJS)
diff -up openssh-5.3p1/Makefile.in.fips openssh-5.3p1/Makefile.in
--- openssh-5.3p1/Makefile.in.fips 2009-10-02 14:12:00.000000000 +0200
+++ openssh-5.3p1/Makefile.in 2009-10-02 14:20:18.000000000 +0200
@@ -136,28 +136,28 @@ libssh.a: $(LIBSSH_OBJS)
$(RANLIB) $@
ssh$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHOBJS)
@ -231,7 +231,7 @@ diff -up openssh-5.2p1/Makefile.in.fips openssh-5.2p1/Makefile.in
sshd$(EXEEXT): libssh.a $(LIBCOMPAT) $(SSHDOBJS)
- $(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHDLIBS) $(LIBS)
+ $(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHDLIBS) -lfipscheck $(LIBS)
+ $(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(SSHDLIBS) $(LIBS)
scp$(EXEEXT): $(LIBCOMPAT) libssh.a scp.o progressmeter.o
$(LD) -o $@ scp.o progressmeter.o bufaux.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
@ -248,19 +248,19 @@ diff -up openssh-5.2p1/Makefile.in.fips openssh-5.2p1/Makefile.in
- $(LD) -o $@ ssh-keygen.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
+ $(LD) -o $@ ssh-keygen.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)
ssh-keysign$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keysign.o
- $(LD) -o $@ ssh-keysign.o readconf.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
+ $(LD) -o $@ ssh-keysign.o readconf.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)
ssh-keysign$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keysign.o roaming_dummy.o
- $(LD) -o $@ ssh-keysign.o readconf.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
+ $(LD) -o $@ ssh-keysign.o readconf.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)
ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o
- $(LD) -o $@ ssh-keyscan.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
+ $(LD) -o $@ ssh-keyscan.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lfipscheck $(LIBS)
ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o roaming_dummy.o
- $(LD) -o $@ ssh-keyscan.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
+ $(LD) -o $@ ssh-keyscan.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lfipscheck $(LIBS)
sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a sftp.o sftp-common.o sftp-server.o sftp-server-main.o
$(LD) -o $@ sftp-server.o sftp-common.o sftp-server-main.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
diff -up openssh-5.2p1/myproposal.h.fips openssh-5.2p1/myproposal.h
--- openssh-5.2p1/myproposal.h.fips 2009-01-28 06:33:31.000000000 +0100
+++ openssh-5.2p1/myproposal.h 2009-05-15 15:51:01.000000000 +0200
diff -up openssh-5.3p1/myproposal.h.fips openssh-5.3p1/myproposal.h
--- openssh-5.3p1/myproposal.h.fips 2009-01-28 06:33:31.000000000 +0100
+++ openssh-5.3p1/myproposal.h 2009-10-02 14:12:00.000000000 +0200
@@ -53,7 +53,12 @@
"hmac-sha1-96,hmac-md5-96"
#define KEX_DEFAULT_COMP "none,zlib@openssh.com,zlib"
@ -275,9 +275,9 @@ diff -up openssh-5.2p1/myproposal.h.fips openssh-5.2p1/myproposal.h
static char *myproposal[PROPOSAL_MAX] = {
KEX_DEFAULT_KEX,
diff -up openssh-5.2p1/nsskeys.c.fips openssh-5.2p1/nsskeys.c
--- openssh-5.2p1/nsskeys.c.fips 2009-05-15 15:51:01.000000000 +0200
+++ openssh-5.2p1/nsskeys.c 2009-05-15 15:51:01.000000000 +0200
diff -up openssh-5.3p1/nsskeys.c.fips openssh-5.3p1/nsskeys.c
--- openssh-5.3p1/nsskeys.c.fips 2009-10-02 14:12:00.000000000 +0200
+++ openssh-5.3p1/nsskeys.c 2009-10-02 14:12:00.000000000 +0200
@@ -183,8 +183,8 @@ nss_convert_pubkey(Key *k)
break;
}
@ -289,9 +289,9 @@ diff -up openssh-5.2p1/nsskeys.c.fips openssh-5.2p1/nsskeys.c
xfree(p);
return 0;
diff -up openssh-5.2p1/openbsd-compat/bsd-arc4random.c.fips openssh-5.2p1/openbsd-compat/bsd-arc4random.c
--- openssh-5.2p1/openbsd-compat/bsd-arc4random.c.fips 2008-06-04 02:54:00.000000000 +0200
+++ openssh-5.2p1/openbsd-compat/bsd-arc4random.c 2009-05-15 15:51:01.000000000 +0200
diff -up openssh-5.3p1/openbsd-compat/bsd-arc4random.c.fips openssh-5.3p1/openbsd-compat/bsd-arc4random.c
--- openssh-5.3p1/openbsd-compat/bsd-arc4random.c.fips 2008-06-04 02:54:00.000000000 +0200
+++ openssh-5.3p1/openbsd-compat/bsd-arc4random.c 2009-10-02 14:12:00.000000000 +0200
@@ -39,6 +39,7 @@
static int rc4_ready = 0;
static RC4_KEY rc4;
@ -333,9 +333,9 @@ diff -up openssh-5.2p1/openbsd-compat/bsd-arc4random.c.fips openssh-5.2p1/openbs
#endif /* !HAVE_ARC4RANDOM */
#ifndef ARC4RANDOM_BUF
diff -up openssh-5.2p1/ssh-add.c.fips openssh-5.2p1/ssh-add.c
--- openssh-5.2p1/ssh-add.c.fips 2009-05-15 15:51:01.000000000 +0200
+++ openssh-5.2p1/ssh-add.c 2009-05-15 15:51:01.000000000 +0200
diff -up openssh-5.3p1/ssh-add.c.fips openssh-5.3p1/ssh-add.c
--- openssh-5.3p1/ssh-add.c.fips 2009-10-02 14:12:00.000000000 +0200
+++ openssh-5.3p1/ssh-add.c 2009-10-02 14:12:00.000000000 +0200
@@ -42,6 +42,7 @@
#include <sys/param.h>
@ -353,9 +353,9 @@ diff -up openssh-5.2p1/ssh-add.c.fips openssh-5.2p1/ssh-add.c
SSH_FP_HEX);
printf("%d %s %s (%s)\n",
key_size(key), fp, comment, key_type(key));
diff -up openssh-5.2p1/ssh-agent.c.fips openssh-5.2p1/ssh-agent.c
--- openssh-5.2p1/ssh-agent.c.fips 2009-05-15 15:51:01.000000000 +0200
+++ openssh-5.2p1/ssh-agent.c 2009-05-15 15:51:01.000000000 +0200
diff -up openssh-5.3p1/ssh-agent.c.fips openssh-5.3p1/ssh-agent.c
--- openssh-5.3p1/ssh-agent.c.fips 2009-10-02 14:12:00.000000000 +0200
+++ openssh-5.3p1/ssh-agent.c 2009-10-02 14:12:00.000000000 +0200
@@ -51,6 +51,7 @@
#include <openssl/evp.h>
@ -377,10 +377,10 @@ diff -up openssh-5.2p1/ssh-agent.c.fips openssh-5.2p1/ssh-agent.c
ret = 0;
xfree(p);
diff -up openssh-5.2p1/ssh.c.fips openssh-5.2p1/ssh.c
--- openssh-5.2p1/ssh.c.fips 2009-05-15 15:51:01.000000000 +0200
+++ openssh-5.2p1/ssh.c 2009-05-15 15:51:01.000000000 +0200
@@ -71,6 +71,8 @@
diff -up openssh-5.3p1/ssh.c.fips openssh-5.3p1/ssh.c
--- openssh-5.3p1/ssh.c.fips 2009-10-02 14:12:00.000000000 +0200
+++ openssh-5.3p1/ssh.c 2009-10-02 14:12:00.000000000 +0200
@@ -72,6 +72,8 @@
#include <openssl/evp.h>
#include <openssl/err.h>
@ -389,7 +389,7 @@ diff -up openssh-5.2p1/ssh.c.fips openssh-5.2p1/ssh.c
#include "openbsd-compat/openssl-compat.h"
#include "openbsd-compat/sys-queue.h"
@@ -220,6 +222,10 @@ main(int ac, char **av)
@@ -221,6 +223,10 @@ main(int ac, char **av)
sanitise_stdfd();
__progname = ssh_get_progname(av[0]);
@ -400,7 +400,7 @@ diff -up openssh-5.2p1/ssh.c.fips openssh-5.2p1/ssh.c
init_rng();
/*
@@ -279,6 +285,9 @@ main(int ac, char **av)
@@ -281,6 +287,9 @@ main(int ac, char **av)
"ACD:F:I:KL:MNO:PR:S:TVw:XYy")) != -1) {
switch (opt) {
case '1':
@ -410,7 +410,7 @@ diff -up openssh-5.2p1/ssh.c.fips openssh-5.2p1/ssh.c
options.protocol = SSH_PROTO_1;
break;
case '2':
@@ -550,7 +559,6 @@ main(int ac, char **av)
@@ -552,7 +561,6 @@ main(int ac, char **av)
if (!host)
usage();
@ -418,7 +418,7 @@ diff -up openssh-5.2p1/ssh.c.fips openssh-5.2p1/ssh.c
ERR_load_crypto_strings();
/* Initialize the command to execute on remote host. */
@@ -635,6 +643,10 @@ main(int ac, char **av)
@@ -638,6 +646,10 @@ main(int ac, char **av)
seed_rng();
@ -429,7 +429,7 @@ diff -up openssh-5.2p1/ssh.c.fips openssh-5.2p1/ssh.c
if (options.user == NULL)
options.user = xstrdup(pw->pw_name);
@@ -701,6 +713,12 @@ main(int ac, char **av)
@@ -704,6 +716,12 @@ main(int ac, char **av)
timeout_ms = options.connection_timeout * 1000;
@ -442,9 +442,9 @@ diff -up openssh-5.2p1/ssh.c.fips openssh-5.2p1/ssh.c
/* Open a connection to the remote host. */
if (ssh_connect(host, &hostaddr, options.port,
options.address_family, options.connection_attempts, &timeout_ms,
diff -up openssh-5.2p1/sshconnect2.c.fips openssh-5.2p1/sshconnect2.c
--- openssh-5.2p1/sshconnect2.c.fips 2009-05-15 15:51:01.000000000 +0200
+++ openssh-5.2p1/sshconnect2.c 2009-05-15 15:51:01.000000000 +0200
diff -up openssh-5.3p1/sshconnect2.c.fips openssh-5.3p1/sshconnect2.c
--- openssh-5.3p1/sshconnect2.c.fips 2009-10-02 14:12:00.000000000 +0200
+++ openssh-5.3p1/sshconnect2.c 2009-10-02 14:12:00.000000000 +0200
@@ -44,6 +44,8 @@
#include <vis.h>
#endif
@ -454,7 +454,7 @@ diff -up openssh-5.2p1/sshconnect2.c.fips openssh-5.2p1/sshconnect2.c
#include "openbsd-compat/sys-queue.h"
#include "xmalloc.h"
@@ -115,6 +117,10 @@ ssh_kex2(char *host, struct sockaddr *ho
@@ -116,6 +118,10 @@ ssh_kex2(char *host, struct sockaddr *ho
if (options.ciphers != NULL) {
myproposal[PROPOSAL_ENC_ALGS_CTOS] =
myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers;
@ -465,7 +465,7 @@ diff -up openssh-5.2p1/sshconnect2.c.fips openssh-5.2p1/sshconnect2.c
}
myproposal[PROPOSAL_ENC_ALGS_CTOS] =
compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_CTOS]);
@@ -130,7 +136,11 @@ ssh_kex2(char *host, struct sockaddr *ho
@@ -131,7 +137,11 @@ ssh_kex2(char *host, struct sockaddr *ho
if (options.macs != NULL) {
myproposal[PROPOSAL_MAC_ALGS_CTOS] =
myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
@ -477,7 +477,7 @@ diff -up openssh-5.2p1/sshconnect2.c.fips openssh-5.2p1/sshconnect2.c
if (options.hostkeyalgorithms != NULL)
myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
options.hostkeyalgorithms;
@@ -507,8 +517,8 @@ input_userauth_pk_ok(int type, u_int32_t
@@ -508,8 +518,8 @@ input_userauth_pk_ok(int type, u_int32_t
key->type, pktype);
goto done;
}
@ -488,9 +488,9 @@ diff -up openssh-5.2p1/sshconnect2.c.fips openssh-5.2p1/sshconnect2.c
xfree(fp);
/*
diff -up openssh-5.2p1/sshconnect.c.fips openssh-5.2p1/sshconnect.c
--- openssh-5.2p1/sshconnect.c.fips 2009-05-15 15:51:01.000000000 +0200
+++ openssh-5.2p1/sshconnect.c 2009-05-15 15:51:01.000000000 +0200
diff -up openssh-5.3p1/sshconnect.c.fips openssh-5.3p1/sshconnect.c
--- openssh-5.3p1/sshconnect.c.fips 2009-10-02 14:12:00.000000000 +0200
+++ openssh-5.3p1/sshconnect.c 2009-10-02 14:12:00.000000000 +0200
@@ -40,6 +40,8 @@
#include <unistd.h>
#include <fcntl.h>
@ -500,7 +500,7 @@ diff -up openssh-5.2p1/sshconnect.c.fips openssh-5.2p1/sshconnect.c
#include "xmalloc.h"
#include "key.h"
#include "hostfile.h"
@@ -761,6 +763,7 @@ check_host_key(char *hostname, struct so
@@ -763,6 +765,7 @@ check_host_key(char *hostname, struct so
goto fail;
} else if (options.strict_host_key_checking == 2) {
char msg1[1024], msg2[1024];
@ -508,7 +508,7 @@ diff -up openssh-5.2p1/sshconnect.c.fips openssh-5.2p1/sshconnect.c
if (show_other_keys(host, host_key))
snprintf(msg1, sizeof(msg1),
@@ -769,8 +772,8 @@ check_host_key(char *hostname, struct so
@@ -771,8 +774,8 @@ check_host_key(char *hostname, struct so
else
snprintf(msg1, sizeof(msg1), ".");
/* The default */
@ -519,7 +519,7 @@ diff -up openssh-5.2p1/sshconnect.c.fips openssh-5.2p1/sshconnect.c
SSH_FP_RANDOMART);
msg2[0] = '\0';
if (options.verify_host_key_dns) {
@@ -786,10 +789,10 @@ check_host_key(char *hostname, struct so
@@ -788,10 +791,10 @@ check_host_key(char *hostname, struct so
snprintf(msg, sizeof(msg),
"The authenticity of host '%.200s (%s)' can't be "
"established%s\n"
@ -532,7 +532,7 @@ diff -up openssh-5.2p1/sshconnect.c.fips openssh-5.2p1/sshconnect.c
options.visual_host_key ? "\n" : "",
options.visual_host_key ? ra : "",
msg2);
@@ -1077,17 +1080,18 @@ show_key_from_file(const char *file, con
@@ -1079,17 +1082,18 @@ show_key_from_file(const char *file, con
Key *found;
char *fp, *ra;
int line, ret;
@ -555,7 +555,7 @@ diff -up openssh-5.2p1/sshconnect.c.fips openssh-5.2p1/sshconnect.c
xfree(ra);
xfree(fp);
}
@@ -1133,8 +1137,9 @@ warn_changed_key(Key *host_key)
@@ -1135,8 +1139,9 @@ warn_changed_key(Key *host_key)
{
char *fp;
const char *type = key_type(host_key);
@ -566,7 +566,7 @@ diff -up openssh-5.2p1/sshconnect.c.fips openssh-5.2p1/sshconnect.c
error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
error("@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @");
@@ -1142,8 +1147,8 @@ warn_changed_key(Key *host_key)
@@ -1144,8 +1149,8 @@ warn_changed_key(Key *host_key)
error("IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!");
error("Someone could be eavesdropping on you right now (man-in-the-middle attack)!");
error("It is also possible that the %s host key has just been changed.", type);
@ -577,9 +577,9 @@ diff -up openssh-5.2p1/sshconnect.c.fips openssh-5.2p1/sshconnect.c
error("Please contact your system administrator.");
xfree(fp);
diff -up openssh-5.2p1/sshd.c.fips openssh-5.2p1/sshd.c
--- openssh-5.2p1/sshd.c.fips 2009-05-15 15:51:01.000000000 +0200
+++ openssh-5.2p1/sshd.c 2009-05-15 15:51:01.000000000 +0200
diff -up openssh-5.3p1/sshd.c.fips openssh-5.3p1/sshd.c
--- openssh-5.3p1/sshd.c.fips 2009-10-02 14:12:00.000000000 +0200
+++ openssh-5.3p1/sshd.c 2009-10-02 14:12:00.000000000 +0200
@@ -76,6 +76,8 @@
#include <openssl/bn.h>
#include <openssl/md5.h>
@ -589,7 +589,7 @@ diff -up openssh-5.2p1/sshd.c.fips openssh-5.2p1/sshd.c
#include "openbsd-compat/openssl-compat.h"
#ifdef HAVE_SECUREWARE
@@ -1260,6 +1262,12 @@ main(int ac, char **av)
@@ -1261,6 +1263,12 @@ main(int ac, char **av)
(void)set_auth_parameters(ac, av);
#endif
__progname = ssh_get_progname(av[0]);
@ -602,7 +602,7 @@ diff -up openssh-5.2p1/sshd.c.fips openssh-5.2p1/sshd.c
init_rng();
/* Save argv. Duplicate so setproctitle emulation doesn't clobber it */
@@ -1412,8 +1420,6 @@ main(int ac, char **av)
@@ -1413,8 +1421,6 @@ main(int ac, char **av)
else
closefrom(REEXEC_DEVCRYPTO_RESERVED_FD);
@ -611,7 +611,7 @@ diff -up openssh-5.2p1/sshd.c.fips openssh-5.2p1/sshd.c
/*
* Force logging to stderr until we have loaded the private host
* key (unless started from inetd)
@@ -1531,6 +1537,10 @@ main(int ac, char **av)
@@ -1532,6 +1538,10 @@ main(int ac, char **av)
debug("private host key: #%d type %d %s", i, key->type,
key_type(key));
}
@ -622,7 +622,7 @@ diff -up openssh-5.2p1/sshd.c.fips openssh-5.2p1/sshd.c
if ((options.protocol & SSH_PROTO_1) && !sensitive_data.have_ssh1_key) {
logit("Disabling protocol version 1. Could not load host key");
options.protocol &= ~SSH_PROTO_1;
@@ -1655,6 +1665,10 @@ main(int ac, char **av)
@@ -1656,6 +1666,10 @@ main(int ac, char **av)
/* Initialize the random number generator. */
arc4random_stir();
@ -633,7 +633,7 @@ diff -up openssh-5.2p1/sshd.c.fips openssh-5.2p1/sshd.c
/* Chdir to the root directory so that the current disk can be
unmounted if desired. */
chdir("/");
@@ -2182,6 +2196,9 @@ do_ssh2_kex(void)
@@ -2183,6 +2197,9 @@ do_ssh2_kex(void)
if (options.ciphers != NULL) {
myproposal[PROPOSAL_ENC_ALGS_CTOS] =
myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers;
@ -643,7 +643,7 @@ diff -up openssh-5.2p1/sshd.c.fips openssh-5.2p1/sshd.c
}
myproposal[PROPOSAL_ENC_ALGS_CTOS] =
compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_CTOS]);
@@ -2191,6 +2208,9 @@ do_ssh2_kex(void)
@@ -2192,6 +2209,9 @@ do_ssh2_kex(void)
if (options.macs != NULL) {
myproposal[PROPOSAL_MAC_ALGS_CTOS] =
myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
@ -653,9 +653,9 @@ diff -up openssh-5.2p1/sshd.c.fips openssh-5.2p1/sshd.c
}
if (options.compression == COMP_NONE) {
myproposal[PROPOSAL_COMP_ALGS_CTOS] =
diff -up openssh-5.2p1/ssh-keygen.c.fips openssh-5.2p1/ssh-keygen.c
--- openssh-5.2p1/ssh-keygen.c.fips 2009-05-15 15:51:01.000000000 +0200
+++ openssh-5.2p1/ssh-keygen.c 2009-05-15 15:51:01.000000000 +0200
diff -up openssh-5.3p1/ssh-keygen.c.fips openssh-5.3p1/ssh-keygen.c
--- openssh-5.3p1/ssh-keygen.c.fips 2009-10-02 14:12:00.000000000 +0200
+++ openssh-5.3p1/ssh-keygen.c 2009-10-02 14:12:00.000000000 +0200
@@ -21,6 +21,7 @@
#include <openssl/evp.h>

2929
openssh-5.3p1-gsskex.patch Normal file
View File

File diff suppressed because it is too large Load Diff

72
openssh-5.1p1-mls.patch → openssh-5.3p1-mls.patch
View File

@ -1,7 +1,18 @@
diff -up openssh-5.1p1/misc.c.mls openssh-5.1p1/misc.c
--- openssh-5.1p1/misc.c.mls 2008-06-13 06:48:59.000000000 +0200
+++ openssh-5.1p1/misc.c 2008-07-23 18:53:37.000000000 +0200
@@ -427,6 +427,7 @@ char *
diff -up openssh-5.3p1/configure.ac.mls openssh-5.3p1/configure.ac
--- openssh-5.3p1/configure.ac.mls 2009-10-02 14:04:31.000000000 +0200
+++ openssh-5.3p1/configure.ac 2009-10-02 14:04:31.000000000 +0200
@@ -3404,6 +3404,7 @@ AC_ARG_WITH(selinux,
SSHDLIBS="$SSHDLIBS $LIBSELINUX"
LIBS="$LIBS $LIBSELINUX"
AC_CHECK_FUNCS(getseuserbyname get_default_context_with_level)
+ AC_CHECK_FUNCS(setkeycreatecon)
LIBS="$save_LIBS"
fi ]
)
diff -up openssh-5.3p1/misc.c.mls openssh-5.3p1/misc.c
--- openssh-5.3p1/misc.c.mls 2009-02-21 22:47:02.000000000 +0100
+++ openssh-5.3p1/misc.c 2009-10-02 14:04:31.000000000 +0200
@@ -423,6 +423,7 @@ char *
colon(char *cp)
{
int flag = 0;
@ -9,7 +20,7 @@ diff -up openssh-5.1p1/misc.c.mls openssh-5.1p1/misc.c
if (*cp == ':') /* Leading colon is part of file name. */
return (0);
@@ -440,8 +441,13 @@ colon(char *cp)
@@ -436,8 +437,13 @@ colon(char *cp)
return (cp+1);
if (*cp == ':' && !flag)
return (cp);
@ -25,23 +36,9 @@ diff -up openssh-5.1p1/misc.c.mls openssh-5.1p1/misc.c
}
return (0);
}
diff -up openssh-5.1p1/session.c.mls openssh-5.1p1/session.c
--- openssh-5.1p1/session.c.mls 2008-06-16 15:29:18.000000000 +0200
+++ openssh-5.1p1/session.c 2008-07-23 18:53:37.000000000 +0200
@@ -1550,10 +1550,6 @@ do_setusercontext(struct passwd *pw)
#endif
if (getuid() != pw->pw_uid || geteuid() != pw->pw_uid)
fatal("Failed to set uids to %u.", (u_int) pw->pw_uid);
-
-#ifdef WITH_SELINUX
- ssh_selinux_setup_exec_context(pw->pw_name);
-#endif
}
static void
diff -up openssh-5.1p1/openbsd-compat/port-linux.c.mls openssh-5.1p1/openbsd-compat/port-linux.c
--- openssh-5.1p1/openbsd-compat/port-linux.c.mls 2008-07-23 18:53:37.000000000 +0200
+++ openssh-5.1p1/openbsd-compat/port-linux.c 2008-07-23 18:53:37.000000000 +0200
diff -up openssh-5.3p1/openbsd-compat/port-linux.c.mls openssh-5.3p1/openbsd-compat/port-linux.c
--- openssh-5.3p1/openbsd-compat/port-linux.c.mls 2009-10-02 14:04:31.000000000 +0200
+++ openssh-5.3p1/openbsd-compat/port-linux.c 2009-10-02 14:04:31.000000000 +0200
@@ -33,12 +33,23 @@
#include "key.h"
#include "hostfile.h"
@ -419,20 +416,23 @@ diff -up openssh-5.1p1/openbsd-compat/port-linux.c.mls openssh-5.1p1/openbsd-com
/* XXX: should these calls fatal() upon failure in enforcing mode? */
diff -up openssh-5.1p1/configure.ac.mls openssh-5.1p1/configure.ac
--- openssh-5.1p1/configure.ac.mls 2008-07-23 18:53:37.000000000 +0200
+++ openssh-5.1p1/configure.ac 2008-07-23 18:53:37.000000000 +0200
@@ -3311,6 +3311,7 @@ AC_ARG_WITH(selinux,
SSHDLIBS="$SSHDLIBS $LIBSELINUX"
LIBS="$LIBS $LIBSELINUX"
AC_CHECK_FUNCS(getseuserbyname get_default_context_with_level)
+ AC_CHECK_FUNCS(setkeycreatecon)
LIBS="$save_LIBS"
fi ]
)
diff -up openssh-5.1p1/sshd.c.mls openssh-5.1p1/sshd.c
--- openssh-5.1p1/sshd.c.mls 2008-07-23 18:53:37.000000000 +0200
+++ openssh-5.1p1/sshd.c 2008-07-23 18:53:37.000000000 +0200
diff -up openssh-5.3p1/session.c.mls openssh-5.3p1/session.c
--- openssh-5.3p1/session.c.mls 2009-08-20 08:20:50.000000000 +0200
+++ openssh-5.3p1/session.c 2009-10-02 14:06:12.000000000 +0200
@@ -1550,10 +1550,6 @@ do_setusercontext(struct passwd *pw)
if (getuid() != pw->pw_uid || geteuid() != pw->pw_uid)
fatal("Failed to set uids to %u.", (u_int) pw->pw_uid);
-
-#ifdef WITH_SELINUX
- ssh_selinux_setup_exec_context(pw->pw_name);
-#endif
}
static void
diff -up openssh-5.3p1/sshd.c.mls openssh-5.3p1/sshd.c
--- openssh-5.3p1/sshd.c.mls 2009-10-02 14:04:31.000000000 +0200
+++ openssh-5.3p1/sshd.c 2009-10-02 14:04:31.000000000 +0200
@@ -1896,6 +1896,9 @@ main(int ac, char **av)
restore_uid();
}

2
openssh-5.2p1-nss-keys.patch → openssh-5.3p1-nss-keys.patch
View File

@ -245,7 +245,7 @@ diff -up openssh-5.3p1/Makefile.in.nss-keys openssh-5.3p1/Makefile.in
+ entropy.o scard-opensc.o gss-genr.o umac.o jpake.o schnorr.o nsskeys.o
SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
sshconnect.o sshconnect1.o sshconnect2.o mux.o
sshconnect.o sshconnect1.o sshconnect2.o mux.o \
diff -up /dev/null openssh-5.3p1/nsskeys.c
--- /dev/null 2009-09-11 09:35:58.778798825 +0200
+++ openssh-5.3p1/nsskeys.c 2009-10-02 14:09:01.000000000 +0200

440
openssh-5.3p1-pka.patch Normal file
View File

@ -0,0 +1,440 @@
diff -up openssh-5.3p1/auth2-pubkey.c.pka openssh-5.3p1/auth2-pubkey.c
--- openssh-5.3p1/auth2-pubkey.c.pka 2009-10-15 06:26:25.000000000 +0200
+++ openssh-5.3p1/auth2-pubkey.c 2009-10-15 06:44:32.000000000 +0200
@@ -184,26 +184,14 @@ done:
/* return 1 if user allows given key */
static int
-user_key_allowed2(struct passwd *pw, Key *key, char *file)
+user_search_key_in_file(FILE *f, char *file, Key* key, struct passwd *pw)
{
char line[SSH_MAX_PUBKEY_BYTES];
int found_key = 0;
- FILE *f;
u_long linenum = 0;
Key *found;
char *fp;
- /* Temporarily use the user's uid. */
- temporarily_use_uid(pw);
-
- debug("trying public key file %s", file);
- f = auth_openkeyfile(file, pw, options.strict_modes);
-
- if (!f) {
- restore_uid();
- return 0;
- }
-
found_key = 0;
found = key_new(key->type);
@@ -248,21 +236,160 @@ user_key_allowed2(struct passwd *pw, Key
break;
}
}
- restore_uid();
- fclose(f);
key_free(found);
if (!found_key)
debug2("key not found");
return found_key;
}
-/* check whether given key is in .ssh/authorized_keys* */
+
+/* return 1 if user allows given key */
+static int
+user_key_allowed2(struct passwd *pw, Key *key, char *file)
+{
+ FILE *f;
+ int found_key = 0;
+
+ /* Temporarily use the user's uid. */
+ temporarily_use_uid(pw);
+
+ debug("trying public key file %s", file);
+ f = auth_openkeyfile(file, pw, options.strict_modes);
+
+ if (f) {
+ found_key = user_search_key_in_file (f, file, key, pw);
+ fclose(f);
+ }
+
+ restore_uid();
+ return found_key;
+}
+
+#ifdef WITH_PUBKEY_AGENT
+
+#define WHITESPACE " \t\r\n"
+
+/* return 1 if user allows given key */
+static int
+user_key_via_agent_allowed2(struct passwd *pw, Key *key)
+{
+ FILE *f;
+ int found_key = 0;
+ char *pubkey_agent_string = NULL;
+ char *tmp_pubkey_agent_string = NULL;
+ char *progname;
+ char *cp;
+ struct passwd *runas_pw;
+ struct stat st;
+
+ if (options.pubkey_agent == NULL || options.pubkey_agent[0] != '/')
+ return -1;
+
+ /* get the run as identity from config */
+ runas_pw = (options.pubkey_agent_runas == NULL)? pw
+ : getpwnam (options.pubkey_agent_runas);
+ if (!runas_pw) {
+ error("%s: getpwnam(\"%s\"): %s", __func__,
+ options.pubkey_agent_runas, strerror(errno));
+ return 0;
+ }
+
+ /* Temporarily use the specified uid. */
+ if (runas_pw->pw_uid != 0)
+ temporarily_use_uid(runas_pw);
+
+ pubkey_agent_string = percent_expand(options.pubkey_agent,
+ "h", pw->pw_dir, "u", pw->pw_name, (char *)NULL);
+
+ /* Test whether agent can be modified by non root user */
+ tmp_pubkey_agent_string = xstrdup (pubkey_agent_string);
+ progname = strtok (tmp_pubkey_agent_string, WHITESPACE);
+
+ debug3("%s: checking program '%s'", __func__, progname);
+
+ if (stat (progname, &st) < 0) {
+ error("%s: stat(\"%s\"): %s", __func__,
+ progname, strerror(errno));
+ goto go_away;
+ }
+
+ if (st.st_uid != 0 || (st.st_mode & 022) != 0) {
+ error("bad ownership or modes for pubkey agent \"%s\"",
+ progname);
+ goto go_away;
+ }
+
+ if (!S_ISREG(st.st_mode)) {
+ error("pubkey agent \"%s\" is not a regular file",
+ progname);
+ goto go_away;
+ }
+
+ /*
+ * Descend the path, checking that each component is a
+ * root-owned directory with strict permissions.
+ */
+ do {
+ if ((cp = strrchr(progname, '/')) == NULL)
+ break;
+ else
+ *cp = '\0';
+
+ debug3("%s: checking component '%s'", __func__, progname);
+
+ if (stat(progname, &st) != 0) {
+ error("%s: stat(\"%s\"): %s", __func__,
+ progname, strerror(errno));
+ goto go_away;
+ }
+ if (st.st_uid != 0 || (st.st_mode & 022) != 0) {
+ error("bad ownership or modes for pubkey agent path component \"%s\"",
+ progname);
+ goto go_away;
+ }
+ if (!S_ISDIR(st.st_mode)) {
+ error("pubkey agent path component \"%s\" is not a directory",
+ progname);
+ goto go_away;
+ }
+ } while (0);
+
+ /* open the pipe and read the keys */
+ f = popen (pubkey_agent_string, "r");
+ if (!f) {
+ error("%s: popen (\"%s\", \"r\"): %s", __func__,
+ pubkey_agent_string, strerror (errno));
+ goto go_away;
+ }
+
+ found_key = user_search_key_in_file (f, options.pubkey_agent, key, pw);
+ pclose (f);
+
+go_away:
+ if (tmp_pubkey_agent_string)
+ xfree (tmp_pubkey_agent_string);
+ if (pubkey_agent_string)
+ xfree (pubkey_agent_string);
+
+ if (runas_pw->pw_uid != 0)
+ restore_uid();
+ return found_key;
+}
+#endif
+
+/* check whether given key is in <pkey_agent or .ssh/authorized_keys* */
int
user_key_allowed(struct passwd *pw, Key *key)
{
int success;
char *file;
+#ifdef WITH_PUBKEY_AGENT
+ success = user_key_via_agent_allowed2(pw, key);
+ if (success >= 0)
+ return success;
+#endif
+
file = authorized_keys_file(pw);
success = user_key_allowed2(pw, key, file);
xfree(file);
diff -up openssh-5.3p1/configure.ac.pka openssh-5.3p1/configure.ac
--- openssh-5.3p1/configure.ac.pka 2009-10-15 06:26:25.000000000 +0200
+++ openssh-5.3p1/configure.ac 2009-10-15 06:26:26.000000000 +0200
@@ -1319,6 +1319,18 @@ AC_ARG_WITH(audit,
esac ]
)
+# Check whether user wants pubkey agent support
+PKA_MSG="no"
+AC_ARG_WITH(pka,
+ [ --with-pka Enable pubkey agent support],
+ [
+ if test "x$withval" != "xno" ; then
+ AC_DEFINE([WITH_PUBKEY_AGENT], 1, [Enable pubkey agent support])
+ PKA_MSG="yes"
+ fi
+ ]
+)
+
dnl Checks for library functions. Please keep in alphabetical order
AC_CHECK_FUNCS( \
arc4random \
@@ -4264,6 +4276,7 @@ echo " Linux audit support
echo " Smartcard support: $SCARD_MSG"
echo " S/KEY support: $SKEY_MSG"
echo " TCP Wrappers support: $TCPW_MSG"
+echo " PKA support: $PKA_MSG"
echo " MD5 password support: $MD5_MSG"
echo " libedit support: $LIBEDIT_MSG"
echo " Solaris process contract support: $SPC_MSG"
diff -up openssh-5.3p1/configure.pka openssh-5.3p1/configure
--- openssh-5.3p1/configure.pka 2009-10-13 19:27:51.000000000 +0200
+++ openssh-5.3p1/configure 2009-10-15 06:26:33.000000000 +0200
@@ -769,6 +769,7 @@ with_skey
with_tcp_wrappers
with_libedit
with_audit
+with_pka
with_ssl_dir
with_openssl_header_check
with_ssl_engine
@@ -1473,6 +1474,7 @@ Optional Packages:
--with-tcp-wrappers[=PATH] Enable tcpwrappers support (optionally in PATH)
--with-libedit[=PATH] Enable libedit support for sftp
--with-audit=module Enable EXPERIMENTAL audit support (modules=debug,bsm)
+ --with-pka Enable pubkey agent support
--with-ssl-dir=PATH Specify path to OpenSSL installation
--without-openssl-header-check Disable OpenSSL version consistency check
--with-ssl-engine Enable OpenSSL (hardware) ENGINE support
@@ -13443,6 +13445,25 @@ $as_echo "$as_me: error: Unknown audit m
fi
+# Check whether user wants pubkey agent support
+PKA_MSG="no"
+
+# Check whether --with-pka was given.
+if test "${with_pka+set}" = set; then
+ withval=$with_pka;
+ if test "x$withval" != "xno" ; then
+
+cat >>confdefs.h <<\_ACEOF
+#define WITH_PUBKEY_AGENT 1
+_ACEOF
+
+ PKA_MSG="yes"
+ fi
+
+
+fi
+
+
@@ -32772,6 +32793,7 @@ echo " Linux audit support
echo " Smartcard support: $SCARD_MSG"
echo " S/KEY support: $SKEY_MSG"
echo " TCP Wrappers support: $TCPW_MSG"
+echo " PKA support: $PKA_MSG"
echo " MD5 password support: $MD5_MSG"
echo " libedit support: $LIBEDIT_MSG"
echo " Solaris process contract support: $SPC_MSG"
diff -up openssh-5.3p1/servconf.c.pka openssh-5.3p1/servconf.c
--- openssh-5.3p1/servconf.c.pka 2009-10-15 06:26:24.000000000 +0200
+++ openssh-5.3p1/servconf.c 2009-10-15 06:26:26.000000000 +0200
@@ -128,6 +128,8 @@ initialize_server_options(ServerOptions
options->num_permitted_opens = -1;
options->adm_forced_command = NULL;
options->chroot_directory = NULL;
+ options->pubkey_agent = NULL;
+ options->pubkey_agent_runas = NULL;
options->zero_knowledge_password_authentication = -1;
}
@@ -310,6 +312,7 @@ typedef enum {
sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
sUsePrivilegeSeparation, sAllowAgentForwarding,
sZeroKnowledgePasswordAuthentication,
+ sPubkeyAgent, sPubkeyAgentRunAs,
sDeprecated, sUnsupported
} ServerOpCodes;
@@ -429,6 +432,13 @@ static struct {
{ "permitopen", sPermitOpen, SSHCFG_ALL },
{ "forcecommand", sForceCommand, SSHCFG_ALL },
{ "chrootdirectory", sChrootDirectory, SSHCFG_ALL },
+#ifdef WITH_PUBKEY_AGENT
+ { "pubkeyagent", sPubkeyAgent, SSHCFG_ALL },
+ { "pubkeyagentrunas", sPubkeyAgentRunAs, SSHCFG_ALL },
+#else
+ { "pubkeyagent", sUnsupported, SSHCFG_ALL },
+ { "pubkeyagentrunas", sUnsupported, SSHCFG_ALL },
+#endif
{ NULL, sBadOption, 0 }
};
@@ -1303,6 +1313,16 @@ process_server_config_line(ServerOptions
*charptr = xstrdup(arg);
break;
+ case sPubkeyAgent:
+ len = strspn(cp, WHITESPACE);
+ if (*activep && options->pubkey_agent == NULL)
+ options->pubkey_agent = xstrdup(cp + len);
+ return 0;
+
+ case sPubkeyAgentRunAs:
+ charptr = &options->pubkey_agent_runas;
+ break;
+
case sDeprecated:
logit("%s line %d: Deprecated option %s",
filename, linenum, arg);
@@ -1396,6 +1416,8 @@ copy_set_server_options(ServerOptions *d
M_CP_INTOPT(gss_authentication);
M_CP_INTOPT(rsa_authentication);
M_CP_INTOPT(pubkey_authentication);
+ M_CP_STROPT(pubkey_agent);
+ M_CP_STROPT(pubkey_agent_runas);
M_CP_INTOPT(kerberos_authentication);
M_CP_INTOPT(hostbased_authentication);
M_CP_INTOPT(kbd_interactive_authentication);
@@ -1636,6 +1658,10 @@ dump_config(ServerOptions *o)
dump_cfg_string(sAuthorizedKeysFile, o->authorized_keys_file);
dump_cfg_string(sAuthorizedKeysFile2, o->authorized_keys_file2);
dump_cfg_string(sForceCommand, o->adm_forced_command);
+#ifdef WITH_PUBKEY_AGENT
+ dump_cfg_string(sPubkeyAgent, o->pubkey_agent);
+ dump_cfg_string(sPubkeyAgentRunAs, o->pubkey_agent_runas);
+#endif
/* string arguments requiring a lookup */
dump_cfg_string(sLogLevel, log_level_name(o->log_level));
diff -up openssh-5.3p1/servconf.h.pka openssh-5.3p1/servconf.h
--- openssh-5.3p1/servconf.h.pka 2009-10-15 06:26:24.000000000 +0200
+++ openssh-5.3p1/servconf.h 2009-10-15 06:26:26.000000000 +0200
@@ -152,6 +152,8 @@ typedef struct {
int num_permitted_opens;
char *chroot_directory;
+ char *pubkey_agent;
+ char *pubkey_agent_runas;
} ServerOptions;
void initialize_server_options(ServerOptions *);
diff -up openssh-5.3p1/sshd_config.0.pka openssh-5.3p1/sshd_config.0
--- openssh-5.3p1/sshd_config.0.pka 2009-10-15 06:26:24.000000000 +0200
+++ openssh-5.3p1/sshd_config.0 2009-10-15 06:26:26.000000000 +0200
@@ -344,10 +344,11 @@ DESCRIPTION
AllowTcpForwarding, Banner, ChrootDirectory, ForceCommand,
GatewayPorts, GSSAPIAuthentication, HostbasedAuthentication,
KbdInteractiveAuthentication, KerberosAuthentication,
- MaxAuthTries, MaxSessions, PasswordAuthentication,
- PermitEmptyPasswords, PermitOpen, PermitRootLogin,
- RhostsRSAAuthentication, RSAAuthentication, X11DisplayOffset,
- X11Forwarding and X11UseLocalHost.
+ MaxAuthTries, MaxSessions, PubkeyAuthentication, PubkeyAgent,
+ PubkeyAgentRunAs, PasswordAuthentication, PermitEmptyPasswords,
+ PermitOpen, PermitRootLogin, RhostsRSAAuthentication,
+ RSAAuthentication, X11DisplayOffset, X11Forwarding and
+ X11UseLocalHost.
MaxAuthTries
Specifies the maximum number of authentication attempts permitted
@@ -455,6 +456,17 @@ DESCRIPTION
fault is ``yes''. Note that this option applies to protocol ver-
sion 2 only.
+ PubkeyAgent
+ Specifies which agent is used for lookup of the user's public
+ keys. Empty string means to use the authorized_keys file. By
+ default there is no PubkeyAgent set. Note that this option has
+ an effect only with PubkeyAuthentication switched on.
+
+ PubkeyAgentRunAs
+ Specifies the user under whose account the PubkeyAgent is run.
+ Empty string (the default value) means the user being authorized
+ is used.
+
RhostsRSAAuthentication
Specifies whether rhosts or /etc/hosts.equiv authentication to-
gether with successful RSA host authentication is allowed. The
diff -up openssh-5.3p1/sshd_config.5.pka openssh-5.3p1/sshd_config.5
--- openssh-5.3p1/sshd_config.5.pka 2009-10-15 06:26:24.000000000 +0200
+++ openssh-5.3p1/sshd_config.5 2009-10-15 06:26:26.000000000 +0200
@@ -610,6 +610,9 @@ Available keywords are
.Cm KerberosAuthentication ,
.Cm MaxAuthTries ,
.Cm MaxSessions ,
+.Cm PubkeyAuthentication ,
+.Cm PubkeyAgent ,
+.Cm PubkeyAgentRunAs ,
.Cm PasswordAuthentication ,
.Cm PermitEmptyPasswords ,
.Cm PermitOpen ,
@@ -805,6 +808,16 @@ Specifies whether public key authenticat
The default is
.Dq yes .
Note that this option applies to protocol version 2 only.
+.It Cm PubkeyAgent
+Specifies which agent is used for lookup of the user's public
+keys. Empty string means to use the authorized_keys file.
+By default there is no PubkeyAgent set.
+Note that this option has an effect only with PubkeyAuthentication
+switched on.
+.It Cm PubkeyAgentRunAs
+Specifies the user under whose account the PubkeyAgent is run. Empty
+string (the default value) means the user being authorized is used.
+.Dq
.It Cm RhostsRSAAuthentication
Specifies whether rhosts or /etc/hosts.equiv authentication together
with successful RSA host authentication is allowed.
diff -up openssh-5.3p1/sshd_config.pka openssh-5.3p1/sshd_config
--- openssh-5.3p1/sshd_config.pka 2009-10-15 06:26:24.000000000 +0200
+++ openssh-5.3p1/sshd_config 2009-10-15 06:26:26.000000000 +0200
@@ -47,6 +47,8 @@ SyslogFacility AUTHPRIV
#RSAAuthentication yes
#PubkeyAuthentication yes
#AuthorizedKeysFile .ssh/authorized_keys
+#PubkeyAgent none
+#PubkeyAgentRunAs nobody
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no

24
openssh-5.2p1-selabel.patch → openssh-5.3p1-selabel.patch
View File

@ -1,6 +1,6 @@
diff -up openssh-5.2p1/contrib/ssh-copy-id.selabel openssh-5.2p1/contrib/ssh-copy-id
--- openssh-5.2p1/contrib/ssh-copy-id.selabel 2009-01-21 10:29:21.000000000 +0100
+++ openssh-5.2p1/contrib/ssh-copy-id 2009-07-08 14:28:27.000000000 +0200
diff -up openssh-5.3p1/contrib/ssh-copy-id.selabel openssh-5.3p1/contrib/ssh-copy-id
--- openssh-5.3p1/contrib/ssh-copy-id.selabel 2009-01-21 10:29:21.000000000 +0100
+++ openssh-5.3p1/contrib/ssh-copy-id 2009-10-02 14:21:54.000000000 +0200
@@ -38,7 +38,7 @@ if [ "$#" -lt 1 ] || [ "$1" = "-h" ] ||
exit 1
fi
@ -10,10 +10,10 @@ diff -up openssh-5.2p1/contrib/ssh-copy-id.selabel openssh-5.2p1/contrib/ssh-cop
cat <<EOF
Now try logging into the machine, with "ssh '$1'", and check in:
diff -up openssh-5.2p1/Makefile.in.selabel openssh-5.2p1/Makefile.in
--- openssh-5.2p1/Makefile.in.selabel 2009-07-08 14:28:25.000000000 +0200
+++ openssh-5.2p1/Makefile.in 2009-07-08 14:28:27.000000000 +0200
@@ -134,7 +134,7 @@ libssh.a: $(LIBSSH_OBJS)
diff -up openssh-5.3p1/Makefile.in.selabel openssh-5.3p1/Makefile.in
--- openssh-5.3p1/Makefile.in.selabel 2009-10-02 14:21:54.000000000 +0200
+++ openssh-5.3p1/Makefile.in 2009-10-02 14:23:23.000000000 +0200
@@ -136,7 +136,7 @@ libssh.a: $(LIBSSH_OBJS)
$(RANLIB) $@
ssh$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHOBJS)
@ -21,10 +21,10 @@ diff -up openssh-5.2p1/Makefile.in.selabel openssh-5.2p1/Makefile.in
+ $(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck -lselinux $(LIBS)
sshd$(EXEEXT): libssh.a $(LIBCOMPAT) $(SSHDOBJS)
$(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHDLIBS) -lfipscheck $(LIBS)
diff -up openssh-5.2p1/ssh.c.selabel openssh-5.2p1/ssh.c
--- openssh-5.2p1/ssh.c.selabel 2009-07-08 14:28:27.000000000 +0200
+++ openssh-5.2p1/ssh.c 2009-07-08 14:34:00.000000000 +0200
$(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(SSHDLIBS) $(LIBS)
diff -up openssh-5.3p1/ssh.c.selabel openssh-5.3p1/ssh.c
--- openssh-5.3p1/ssh.c.selabel 2009-10-02 14:21:54.000000000 +0200
+++ openssh-5.3p1/ssh.c 2009-10-02 14:21:54.000000000 +0200
@@ -74,6 +74,7 @@
#include <openssl/err.h>
#include <openssl/fips.h>
@ -33,7 +33,7 @@ diff -up openssh-5.2p1/ssh.c.selabel openssh-5.2p1/ssh.c
#include "openbsd-compat/openssl-compat.h"
#include "openbsd-compat/sys-queue.h"
@@ -791,10 +792,15 @@ main(int ac, char **av)
@@ -792,10 +793,15 @@ main(int ac, char **av)
*/
r = snprintf(buf, sizeof buf, "%s%s%s", pw->pw_dir,
strcmp(pw->pw_dir, "/") ? "/" : "", _PATH_SSH_USER_DIR);

24
openssh-5.3p1-skip-initial.patch Normal file
View File

@ -0,0 +1,24 @@
diff -up openssh-5.3p1/auth1.c.skip-initial openssh-5.3p1/auth1.c
--- openssh-5.3p1/auth1.c.skip-initial 2009-03-08 01:40:28.000000000 +0100
+++ openssh-5.3p1/auth1.c 2009-10-02 13:55:00.000000000 +0200
@@ -244,7 +244,7 @@ do_authloop(Authctxt *authctxt)
authctxt->valid ? "" : "invalid user ", authctxt->user);
/* If the user has no password, accept authentication immediately. */
- if (options.password_authentication &&
+ if (options.permit_empty_passwd && options.password_authentication &&
#ifdef KRB5
(!options.kerberos_authentication || options.kerberos_or_local_passwd) &&
#endif
diff -up openssh-5.3p1/auth2-none.c.skip-initial openssh-5.3p1/auth2-none.c
--- openssh-5.3p1/auth2-none.c.skip-initial 2009-03-08 01:40:28.000000000 +0100
+++ openssh-5.3p1/auth2-none.c 2009-10-02 13:56:21.000000000 +0200
@@ -61,7 +61,7 @@ userauth_none(Authctxt *authctxt)
{
none_enabled = 0;
packet_check_eom();
- if (options.password_authentication)
+ if (options.permit_empty_passwd && options.password_authentication)
return (PRIVSEP(auth_password(authctxt, "")));
return (0);
}

113
openssh.spec
View File

@ -32,6 +32,9 @@
# Whether or not /sbin/nologin exists.
%define nologin 1
# Whether to build pam_ssh_agent_auth
%define pam_ssh_agent 1
# Reserve options to override askpass settings with:
# rpm -ba|--rebuild --define 'skip_xxx 1'
%{?skip_gnome_askpass:%define no_gnome_askpass 1}
@ -58,13 +61,17 @@
%if %{rescue}
%define kerberos5 0
%define libedit 0
%define pam_ssh_agent 0
%endif
%define pam_ssh_agent_ver 0.9
Summary: An open source implementation of SSH protocol versions 1 and 2
Name: openssh
Version: 5.2p1
Release: 31%{?dist}%{?rescue_rel}
Version: 5.3p1
Release: 9%{?dist}%{?rescue_rel}
URL: http://www.openssh.com/portable.html
#URL1: http://pamsshauth.sourceforge.net
#Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
#Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc
# This package differs from the upstream OpenSSH tarball in that
@ -74,13 +81,15 @@ Source0: openssh-%{version}-noacss.tar.bz2
Source1: openssh-nukeacss.sh
Source2: sshd.pam
Source3: sshd.init
Source4: http://prdownloads.sourceforge.net/pamsshagentauth/pam_ssh_agent_auth/pam_ssh_agent_auth-%{pam_ssh_agent_ver}.tar.bz2
Source5: pam_ssh_agent-rmheaders
Patch0: openssh-5.2p1-redhat.patch
Patch2: openssh-5.1p1-skip-initial.patch
Patch3: openssh-3.8.1p1-krb5-config.patch
Patch2: openssh-5.3p1-skip-initial.patch
Patch4: openssh-5.2p1-vendor.patch
Patch10: pam_ssh_agent_auth-0.9-build.patch
Patch12: openssh-5.2p1-selinux.patch
Patch13: openssh-5.1p1-mls.patch
Patch16: openssh-4.7p1-audit.patch
Patch13: openssh-5.3p1-mls.patch
Patch16: openssh-5.3p1-audit.patch
Patch18: openssh-5.0p1-pam_selinux.patch
Patch19: openssh-5.2p1-sesftp.patch
Patch22: openssh-3.9p1-askpass-keep-above.patch
@ -92,13 +101,14 @@ Patch38: openssh-4.3p2-askpass-grab-info.patch
Patch39: openssh-4.3p2-no-v6only.patch
Patch44: openssh-5.2p1-allow-ip-opts.patch
Patch49: openssh-4.3p2-gssapi-canohost.patch
Patch51: openssh-5.2p1-nss-keys.patch
Patch51: openssh-5.3p1-nss-keys.patch
Patch55: openssh-5.1p1-cloexec.patch
Patch62: openssh-5.1p1-scp-manpage.patch
Patch65: openssh-5.2p1-fips.patch
Patch68: openssh-5.2p1-pathmax.patch
Patch69: openssh-5.2p1-selabel.patch
Patch65: openssh-5.3p1-fips.patch
Patch69: openssh-5.3p1-selabel.patch
Patch71: openssh-5.2p1-edns.patch
Patch72: openssh-5.3p1-pka.patch
Patch73: openssh-5.3p1-gsskex.patch
License: BSD
Group: Applications/Internet
@ -170,6 +180,14 @@ Requires: openssh = %{version}-%{release}
Obsoletes: openssh-askpass-gnome
Provides: openssh-askpass-gnome
%package -n pam_ssh_agent_auth
Summary: PAM module for authentication with ssh-agent
Group: System Environment/Base
Version: %{pam_ssh_agent_ver}
# There is special exception added to the GPLv3+ license to
# permit linking with OpenSSL licensed code
License: GPLv3+ and OpenSSL and BSD
%description
SSH (Secure SHell) is a program for logging into and executing
commands on a remote machine. SSH is intended to replace rlogin and
@ -200,13 +218,28 @@ OpenSSH is a free version of SSH (Secure SHell), a program for logging
into and executing commands on a remote machine. This package contains
an X11 passphrase dialog for OpenSSH.
%description -n pam_ssh_agent_auth
This package contains a PAM module which can be used to authenticate
users using ssh keys stored in a ssh-agent. Through the use of the
forwarding of ssh-agent connection it also allows to authenticate with
remote ssh-agent instance.
The module is most useful for su and sudo service stacks.
%prep
%setup -q
%setup -q -a 4
%patch0 -p1 -b .redhat
%patch2 -p1 -b .skip-initial
%patch3 -p1 -b .krb5-config
%patch4 -p1 -b .vendor
%if %{pam_ssh_agent}
pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver}
%patch10 -p1 -b .psaa-build
# Remove duplicate headers
rm -f $(cat %{SOURCE5})
popd
%endif
%if %{WITH_SELINUX}
#SELinux
%patch12 -p1 -b .selinux
@ -229,9 +262,10 @@ an X11 passphrase dialog for OpenSSH.
%patch55 -p1 -b .cloexec
%patch62 -p1 -b .manpage
%patch65 -p1 -b .fips
%patch68 -p1 -b .pathmax
%patch69 -p1 -b .selabel
%patch71 -p1 -b .edns
%patch72 -p1 -b .pka
%patch73 -p1 -b .gsskex
autoreconf
@ -242,11 +276,12 @@ CFLAGS="$CFLAGS -Os"
%endif
%if %{pie}
%ifarch s390 s390x sparc sparcv9 sparc64
CFLAGS="$CFLAGS -fPIE"
CFLAGS="$CFLAGS -fPIC"
%else
CFLAGS="$CFLAGS -fpie"
CFLAGS="$CFLAGS -fpic"
%endif
export CFLAGS
SAVE_LDFLAGS="$LDFLAGS"
LDFLAGS="$LDFLAGS -pie"; export LDFLAGS
%endif
%if %{kerberos5}
@ -326,6 +361,14 @@ fi
popd
%endif
%if %{pam_ssh_agent}
pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver}
LDFLAGS="$SAVE_LDFLAGS"
%configure --with-selinux --libexecdir=/%{_lib}/security
make
popd
%endif
# Add generation of HMAC checksums of the final stripped binaries
%define __spec_install_post \
%{?__debug_package:%{__debug_install_post}} \
@ -375,6 +418,12 @@ rm -f README.nss.nss-keys
%if ! %{nss}
rm -f README.nss
%endif
%if %{pam_ssh_agent}
pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver}
make install DESTDIR=$RPM_BUILD_ROOT
popd
%endif
%clean
rm -rf $RPM_BUILD_ROOT
@ -465,14 +514,42 @@ fi
%attr(0755,root,root) %{_libexecdir}/openssh/ssh-askpass
%endif
%if %{pam_ssh_agent}
%files -n pam_ssh_agent_auth
%defattr(-,root,root)
%doc pam_ssh_agent_auth-%{pam_ssh_agent_ver}/GPL_LICENSE
%doc pam_ssh_agent_auth-%{pam_ssh_agent_ver}/OPENSSH_LICENSE
%doc pam_ssh_agent_auth-%{pam_ssh_agent_ver}/LICENSE.OpenSSL
%attr(0755,root,root) /%{_lib}/security/pam_ssh_agent_auth.so
%attr(0644,root,root) %{_mandir}/man8/pam_ssh_agent_auth.8*
%endif
%changelog
* Mon Nov 2 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-31
* Fri Nov 20 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-8
- Add gssapi key exchange patch (#455351)
* Fri Nov 20 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-8
- Add public key agent patch (#455350)
* Mon Nov 2 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-7
- Repair canohost patch to allow gssapi to work when host is acessed via pipe proxy (#531849)
* Thu Oct 29 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-30
* Thu Oct 29 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-6
- Modify the init script to prevent it to hang during generating the keys (#515145)
* Tue Oct 27 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-29
* Tue Oct 27 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-5
- Add README.nss
* Mon Oct 19 2009 Tomas Mraz <tmraz@redhat.com> - 5.3p1-4
- Add pam_ssh_agent_auth module to a subpackage.
* Fri Oct 16 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-3
- Reenable audit.
* Fri Oct 2 2009 Jan F. Chadima <jchadima@redhat.com> - 5.3p1-2
- Upgrade to new wersion 5.3p1
* Tue Sep 29 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-29
- Resolve locking in ssh-add (#491312)
* Thu Sep 24 2009 Jan F. Chadima <jchadima@redhat.com> - 5.2p1-28

20
pam_ssh_agent-rmheaders Normal file
View File

@ -0,0 +1,20 @@
atomicio.h
authfd.h
buffer.h
cipher.h
compat.h
defines.h
entropy.h
includes.h
kex.h
key.h
log.h
match.h
misc.h
pathnames.h
platform.h
rsa.h
ssh.h
ssh2.h
uuencode.h
xmalloc.h

190
pam_ssh_agent_auth-0.9-build.patch Normal file
View File

@ -0,0 +1,190 @@
diff -up pam_ssh_agent_auth-0.9/iterate_ssh_agent_keys.c.psaa-build pam_ssh_agent_auth-0.9/iterate_ssh_agent_keys.c
--- pam_ssh_agent_auth-0.9/iterate_ssh_agent_keys.c.psaa-build 2009-08-08 11:51:04.000000000 +0200
+++ pam_ssh_agent_auth-0.9/iterate_ssh_agent_keys.c 2009-10-16 15:20:55.000000000 +0200
@@ -41,7 +41,16 @@
#include "buffer.h"
#include "key.h"
#include "authfd.h"
+#include "ssh.h"
#include <stdio.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <fcntl.h>
#include <openssl/evp.h>
#include "userauth_pubkey_from_id.h"
@@ -73,6 +82,96 @@ session_id2_gen()
return cookie;
}
+/*
+ * Added by Jamie Beverly, ensure socket fd points to a socket owned by the user
+ * A cursory check is done, but to avoid race conditions, it is necessary
+ * to drop effective UID when connecting to the socket.
+ *
+ * If the cause of error is EACCES, because we verified we would not have that
+ * problem initially, we can safely assume that somebody is attempting to find a
+ * race condition; so a more "direct" log message is generated.
+ */
+
+int
+ssh_get_authentication_socket_for_uid(uid_t uid)
+{
+ const char *authsocket;
+ int sock;
+ struct sockaddr_un sunaddr;
+ struct stat sock_st;
+
+ authsocket = getenv(SSH_AUTHSOCKET_ENV_NAME);
+ if (!authsocket)
+ return -1;
+
+ /* Advisory only; seteuid ensures no race condition; but will only log if we see EACCES */
+ if( stat(authsocket,&sock_st) == 0) {
+ if(uid != 0 && sock_st.st_uid != uid) {
+ fatal("uid %lu attempted to open an agent socket owned by uid %lu", (unsigned long) uid, (unsigned long) sock_st.st_uid);
+ return -1;
+ }
+ }
+
+ /*
+ * Ensures that the EACCES tested for below can _only_ happen if somebody
+ * is attempting to race the stat above to bypass authentication.
+ */
+ if( (sock_st.st_mode & S_IWUSR) != S_IWUSR || (sock_st.st_mode & S_IRUSR) != S_IRUSR) {
+ error("ssh-agent socket has incorrect permissions for owner");
+ return -1;
+ }
+
+ sunaddr.sun_family = AF_UNIX;
+ strlcpy(sunaddr.sun_path, authsocket, sizeof(sunaddr.sun_path));
+
+ sock = socket(AF_UNIX, SOCK_STREAM, 0);
+ if (sock < 0)
+ return -1;
+
+ /* close on exec */
+ if (fcntl(sock, F_SETFD, 1) == -1) {
+ close(sock);
+ return -1;
+ }
+
+ errno = 0;
+ seteuid(uid); /* To ensure a race condition is not used to circumvent the stat
+ above, we will temporarily drop UID to the caller */
+ if (connect(sock, (struct sockaddr *)&sunaddr, sizeof sunaddr) < 0) {
+ close(sock);
+ if(errno == EACCES)
+ fatal("MAJOR SECURITY WARNING: uid %lu made a deliberate and malicious attempt to open an agent socket owned by another user", (unsigned long) uid);
+ return -1;
+ }
+
+ seteuid(0); /* we now continue the regularly scheduled programming */
+
+ return sock;
+}
+
+AuthenticationConnection *
+ssh_get_authentication_connection_for_uid(uid_t uid)
+{
+ AuthenticationConnection *auth;
+ int sock;
+
+ sock = ssh_get_authentication_socket_for_uid(uid);
+
+ /*
+ * Fail if we couldn't obtain a connection. This happens if we
+ * exited due to a timeout.
+ */
+ if (sock < 0)
+ return NULL;
+
+ auth = xmalloc(sizeof(*auth));
+ auth->fd = sock;
+ buffer_init(&auth->identities);
+ auth->howmany = 0;
+
+ return auth;
+}
+
int
find_authorized_keys(uid_t uid)
{
@@ -85,7 +184,7 @@ find_authorized_keys(uid_t uid)
OpenSSL_add_all_digests();
session_id2 = session_id2_gen();
- if ((ac = ssh_get_authentication_connection(uid))) {
+ if ((ac = ssh_get_authentication_connection_for_uid(uid))) {
verbose("Contacted ssh-agent of user %s (%u)", getpwuid(uid)->pw_name, uid);
for (key = ssh_get_first_identity(ac, &comment, 2); key != NULL; key = ssh_get_next_identity(ac, &comment, 2))
{
@@ -113,3 +212,4 @@ find_authorized_keys(uid_t uid)
EVP_cleanup();
return retval;
}
+
diff -up pam_ssh_agent_auth-0.9/Makefile.in.psaa-build pam_ssh_agent_auth-0.9/Makefile.in
--- pam_ssh_agent_auth-0.9/Makefile.in.psaa-build 2009-08-06 07:40:16.000000000 +0200
+++ pam_ssh_agent_auth-0.9/Makefile.in 2009-10-16 15:20:55.000000000 +0200
@@ -28,7 +28,7 @@ PATHS=
CC=@CC@
LD=@LD@
CFLAGS=@CFLAGS@
-CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ $(PATHS) @DEFS@
+CPPFLAGS=-I.. -I$(srcdir) -I/usr/include/nss3 -I/usr/include/nspr4 @CPPFLAGS@ $(PATHS) @DEFS@
LIBS=@LIBS@
AR=@AR@
AWK=@AWK@
@@ -37,7 +37,7 @@ INSTALL=@INSTALL@
PERL=@PERL@
SED=@SED@
ENT=@ENT@
-LDFLAGS=-L. -Lopenbsd-compat/ @LDFLAGS@
+LDFLAGS=-L.. -L../openbsd-compat/ @LDFLAGS@
LDFLAGS_SHARED = @LDFLAGS_SHARED@
EXEEXT=@EXEEXT@
@@ -48,7 +48,7 @@ PAM_MODULES=pam_ssh_agent_auth.so
SSHOBJS=xmalloc.o atomicio.o authfd.o bufaux.o bufbn.o buffer.o cleanup.o entropy.o fatal.o key.o log.o misc.o secure_filename.o ssh-dss.o ssh-rsa.o uuencode.o compat.o
-PAM_SSH_AGENT_AUTH_OBJS=pam_user_key_allowed2.o iterate_ssh_agent_keys.o userauth_pubkey_from_id.o pam_user_authorized_keys.o
+PAM_SSH_AGENT_AUTH_OBJS=pam_user_key_allowed2.o iterate_ssh_agent_keys.o userauth_pubkey_from_id.o pam_user_authorized_keys.o secure_filename.o
MANPAGES_IN = pam_ssh_agent_auth.pod
@@ -67,13 +67,13 @@ $(PAM_MODULES): Makefile.in config.h
.c.o:
$(CC) $(CFLAGS) $(CPPFLAGS) -c $<
-LIBCOMPAT=openbsd-compat/libopenbsd-compat.a
+LIBCOMPAT=../openbsd-compat/libopenbsd-compat.a
$(LIBCOMPAT): always
(cd openbsd-compat && $(MAKE))
always:
-pam_ssh_agent_auth.so: $(LIBCOMPAT) $(SSHOBJS) $(PAM_SSH_AGENT_AUTH_OBJS) pam_ssh_agent_auth.o
- $(LD) $(LDFLAGS_SHARED) -o $@ $(SSHOBJS) $(PAM_SSH_AGENT_AUTH_OBJS) $(LDFLAGS) -lopenbsd-compat $(LIBS) -lpam pam_ssh_agent_auth.o
+pam_ssh_agent_auth.so: $(PAM_SSH_AGENT_AUTH_OBJS) pam_ssh_agent_auth.o
+ $(LD) $(LDFLAGS_SHARED) -o $@ $(PAM_SSH_AGENT_AUTH_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) -lpam -lnss3 pam_ssh_agent_auth.o
$(MANPAGES): $(MANPAGES_IN)
pod2man --section=8 --release=v0.8 --name=pam_ssh_agent_auth --official --center "PAM" pam_ssh_agent_auth.pod > pam_ssh_agent_auth.8
diff -up pam_ssh_agent_auth-0.9/pam_user_authorized_keys.c.psaa-build pam_ssh_agent_auth-0.9/pam_user_authorized_keys.c
--- pam_ssh_agent_auth-0.9/pam_user_authorized_keys.c.psaa-build 2009-07-29 02:46:38.000000000 +0200
+++ pam_ssh_agent_auth-0.9/pam_user_authorized_keys.c 2009-10-16 15:50:36.000000000 +0200
@@ -94,7 +94,7 @@ parse_authorized_key_file(const char *us
/*
* temporary copy, so that both tilde expansion and percent expansion both get to apply to the path
*/
- strncat(auth_keys_file_buf, authorized_keys_file_input, 4096);
+ strncat(auth_keys_file_buf, authorized_keys_file_input, sizeof(auth_keys_file_buf)-1);
if(allow_user_owned_authorized_keys_file)
authorized_keys_file_allowed_owner_uid = getpwnam(user)->pw_uid;

3
sources
View File

@ -1 +1,2 @@
41c61b5e2c2cddfd53897582b114ffe1 openssh-5.2p1-noacss.tar.bz2
89f85c1da83c24ca0b10c05344f7c93c openssh-5.3p1-noacss.tar.bz2
1868cb825393678489b1d48c97819f76 pam_ssh_agent_auth-0.9.tar.bz2