Merge remote-tracking branch 'origin/master' into f21
This commit is contained in:
commit
6a46008ce7
|
@ -0,0 +1,24 @@
|
||||||
|
diff --git a/misc.c b/misc.c
|
||||||
|
index 2f11de4..36402d1 100644
|
||||||
|
--- a/misc.c
|
||||||
|
+++ b/misc.c
|
||||||
|
@@ -396,7 +396,7 @@ hpdelim(char **cp)
|
||||||
|
return NULL;
|
||||||
|
else
|
||||||
|
s++;
|
||||||
|
- } else if ((s = strpbrk(s, ":/")) == NULL)
|
||||||
|
+ } else if ((s = strpbrk(s, ":")) == NULL)
|
||||||
|
s = *cp + strlen(*cp); /* skip to end (see first case below) */
|
||||||
|
|
||||||
|
switch (*s) {
|
||||||
|
@@ -405,7 +405,6 @@ hpdelim(char **cp)
|
||||||
|
break;
|
||||||
|
|
||||||
|
case ':':
|
||||||
|
- case '/':
|
||||||
|
*s = '\0'; /* terminate */
|
||||||
|
*cp = s + 1;
|
||||||
|
break;
|
||||||
|
--
|
||||||
|
2.1.0
|
||||||
|
|
|
@ -0,0 +1,14 @@
|
||||||
|
--- a/scp.c
|
||||||
|
+++ a/scp.c
|
||||||
|
@@ -1084,6 +1084,10 @@ sink(int argc, char **argv)
|
||||||
|
free(vect[0]);
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
+ if (buf[0] == 'C' && ! exists && np[strlen(np)-1] == '/') {
|
||||||
|
+ errno = ENOTDIR;
|
||||||
|
+ goto bad;
|
||||||
|
+ }
|
||||||
|
omode = mode;
|
||||||
|
mode |= S_IWUSR;
|
||||||
|
if ((ofd = open(np, O_WRONLY|O_CREAT, mode)) < 0) {
|
||||||
|
--
|
|
@ -0,0 +1,137 @@
|
||||||
|
diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
|
||||||
|
index 0a4930e..a7c0c5f 100644
|
||||||
|
--- a/gss-serv-krb5.c
|
||||||
|
+++ b/gss-serv-krb5.c
|
||||||
|
@@ -260,7 +260,6 @@ ssh_gssapi_krb5_cmdok(krb5_principal principal, const char *name,
|
||||||
|
FILE *fp;
|
||||||
|
char file[MAXPATHLEN];
|
||||||
|
char line[BUFSIZ];
|
||||||
|
- char kuser[65]; /* match krb5_kuserok() */
|
||||||
|
struct stat st;
|
||||||
|
struct passwd *pw = the_authctxt->pw;
|
||||||
|
int found_principal = 0;
|
||||||
|
@@ -269,7 +268,7 @@ ssh_gssapi_krb5_cmdok(krb5_principal principal, const char *name,
|
||||||
|
|
||||||
|
snprintf(file, sizeof(file), "%s/.k5users", pw->pw_dir);
|
||||||
|
/* If both .k5login and .k5users DNE, self-login is ok. */
|
||||||
|
- if (!k5login_exists && (access(file, F_OK) == -1)) {
|
||||||
|
+ if ( !options.enable_k5users || (!k5login_exists && (access(file, F_OK) == -1))) {
|
||||||
|
return ssh_krb5_kuserok(krb_context, principal, luser,
|
||||||
|
k5login_exists);
|
||||||
|
}
|
||||||
|
diff --git a/servconf.c b/servconf.c
|
||||||
|
index d482e79..ad5869b 100644
|
||||||
|
--- a/servconf.c
|
||||||
|
+++ b/servconf.c
|
||||||
|
@@ -158,6 +158,7 @@ initialize_server_options(ServerOptions *options)
|
||||||
|
options->ip_qos_bulk = -1;
|
||||||
|
options->version_addendum = NULL;
|
||||||
|
options->use_kuserok = -1;
|
||||||
|
+ options->enable_k5users = -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
void
|
||||||
|
@@ -315,6 +316,8 @@ fill_default_server_options(ServerOptions *options)
|
||||||
|
options->show_patchlevel = 0;
|
||||||
|
if (options->use_kuserok == -1)
|
||||||
|
options->use_kuserok = 1;
|
||||||
|
+ if (options->enable_k5users == -1)
|
||||||
|
+ options->enable_k5users = 0;
|
||||||
|
|
||||||
|
/* Turn privilege separation on by default */
|
||||||
|
if (use_privsep == -1)
|
||||||
|
@@ -356,7 +359,7 @@ typedef enum {
|
||||||
|
sBanner, sShowPatchLevel, sUseDNS, sHostbasedAuthentication,
|
||||||
|
sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
|
||||||
|
sClientAliveCountMax, sAuthorizedKeysFile,
|
||||||
|
- sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor,
|
||||||
|
+ sGssAuthentication, sGssCleanupCreds, sGssEnablek5users, sGssStrictAcceptor,
|
||||||
|
sGssKeyEx, sGssStoreRekey, sAcceptEnv, sPermitTunnel,
|
||||||
|
sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
|
||||||
|
sUsePrivilegeSeparation, sAllowAgentForwarding,
|
||||||
|
@@ -430,6 +433,7 @@ static struct {
|
||||||
|
{ "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL },
|
||||||
|
{ "gssapikeyexchange", sGssKeyEx, SSHCFG_GLOBAL },
|
||||||
|
{ "gssapistorecredentialsonrekey", sGssStoreRekey, SSHCFG_GLOBAL },
|
||||||
|
+ { "gssapienablek5users", sGssEnablek5users, SSHCFG_ALL },
|
||||||
|
#else
|
||||||
|
{ "gssapiauthentication", sUnsupported, SSHCFG_ALL },
|
||||||
|
{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
|
||||||
|
@@ -437,6 +441,7 @@ static struct {
|
||||||
|
{ "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL },
|
||||||
|
{ "gssapikeyexchange", sUnsupported, SSHCFG_GLOBAL },
|
||||||
|
{ "gssapistorecredentialsonrekey", sUnsupported, SSHCFG_GLOBAL },
|
||||||
|
+ { "gssapienablek5users", sUnsupported, SSHCFG_ALL },
|
||||||
|
#endif
|
||||||
|
{ "gssusesessionccache", sUnsupported, SSHCFG_GLOBAL },
|
||||||
|
{ "gssapiusesessioncredcache", sUnsupported, SSHCFG_GLOBAL },
|
||||||
|
@@ -1536,6 +1541,10 @@ process_server_config_line(ServerOptions *options, char *line,
|
||||||
|
intptr = &options->use_kuserok;
|
||||||
|
goto parse_flag;
|
||||||
|
|
||||||
|
+ case sGssEnablek5users:
|
||||||
|
+ intptr = &options->enable_k5users;
|
||||||
|
+ goto parse_flag;
|
||||||
|
+
|
||||||
|
case sPermitOpen:
|
||||||
|
arg = strdelim(&cp);
|
||||||
|
if (!arg || *arg == '\0')
|
||||||
|
@@ -1824,6 +1833,7 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
|
||||||
|
M_CP_INTOPT(ip_qos_interactive);
|
||||||
|
M_CP_INTOPT(ip_qos_bulk);
|
||||||
|
M_CP_INTOPT(use_kuserok);
|
||||||
|
+ M_CP_INTOPT(enable_k5users);
|
||||||
|
M_CP_INTOPT(rekey_limit);
|
||||||
|
M_CP_INTOPT(rekey_interval);
|
||||||
|
|
||||||
|
@@ -2076,6 +2086,7 @@ dump_config(ServerOptions *o)
|
||||||
|
dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
|
||||||
|
dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
|
||||||
|
dump_cfg_fmtint(sKerberosUseKuserok, o->use_kuserok);
|
||||||
|
+ dump_cfg_fmtint(sGssEnablek5users, o->enable_k5users);
|
||||||
|
|
||||||
|
/* string arguments */
|
||||||
|
dump_cfg_string(sPidFile, o->pid_file);
|
||||||
|
diff --git a/servconf.h b/servconf.h
|
||||||
|
index 5117dfa..d63cb71 100644
|
||||||
|
--- a/servconf.h
|
||||||
|
+++ b/servconf.h
|
||||||
|
@@ -173,7 +173,8 @@ typedef struct {
|
||||||
|
|
||||||
|
int num_permitted_opens;
|
||||||
|
|
||||||
|
- int use_kuserok;
|
||||||
|
+ int use_kuserok;
|
||||||
|
+ int enable_k5users;
|
||||||
|
char *chroot_directory;
|
||||||
|
char *revoked_keys_file;
|
||||||
|
char *trusted_user_ca_keys;
|
||||||
|
diff --git a/sshd_config b/sshd_config
|
||||||
|
index 43671f6..6ab00ed 100644
|
||||||
|
--- a/sshd_config
|
||||||
|
+++ b/sshd_config
|
||||||
|
@@ -94,6 +94,7 @@ GSSAPIAuthentication yes
|
||||||
|
GSSAPICleanupCredentials no
|
||||||
|
#GSSAPIStrictAcceptorCheck yes
|
||||||
|
#GSSAPIKeyExchange no
|
||||||
|
+#GSSAPIEnablek5users no
|
||||||
|
|
||||||
|
# Set this to 'yes' to enable PAM authentication, account processing,
|
||||||
|
# and session processing. If this is enabled, PAM authentication will
|
||||||
|
diff --git a/sshd_config.5 b/sshd_config.5
|
||||||
|
index e0e5fff..aa9525d 100644
|
||||||
|
--- a/sshd_config.5
|
||||||
|
+++ b/sshd_config.5
|
||||||
|
@@ -505,6 +505,12 @@ on logout.
|
||||||
|
The default is
|
||||||
|
.Dq yes .
|
||||||
|
Note that this option applies to protocol version 2 only.
|
||||||
|
+.It Cm GSSAPIEnablek5users
|
||||||
|
+Specifies whether to look at .k5users file for GSSAPI authentication
|
||||||
|
+access control. Further details are described in
|
||||||
|
+.Xr ksu 1 .
|
||||||
|
+The default is
|
||||||
|
+.Dq no .
|
||||||
|
.It Cm GSSAPIStrictAcceptorCheck
|
||||||
|
Determines whether to be strict about the identity of the GSSAPI acceptor
|
||||||
|
a client authenticates against. If
|
|
@ -1162,7 +1162,7 @@ new file mode 100644
|
||||||
index 0000000..525060a
|
index 0000000..525060a
|
||||||
--- /dev/null
|
--- /dev/null
|
||||||
+++ b/ldapconf.c
|
+++ b/ldapconf.c
|
||||||
@@ -0,0 +1,720 @@
|
@@ -0,0 +1,722 @@
|
||||||
+/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
|
+/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
|
||||||
+/*
|
+/*
|
||||||
+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
|
+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
|
||||||
|
@ -1479,6 +1479,7 @@ index 0000000..525060a
|
||||||
+ else
|
+ else
|
||||||
+ fatal("%.200s line %d: Bad soft/hard argument.", filename, linenum);
|
+ fatal("%.200s line %d: Bad soft/hard argument.", filename, linenum);
|
||||||
+ if (*intptr == -1)
|
+ if (*intptr == -1)
|
||||||
|
+ *intptr = value;
|
||||||
+ break;
|
+ break;
|
||||||
+
|
+
|
||||||
+ case lSSLPath:
|
+ case lSSLPath:
|
||||||
|
@ -1543,6 +1544,7 @@ index 0000000..525060a
|
||||||
+ else
|
+ else
|
||||||
+ fatal("%.200s line %d: Bad never/hard/demand/alow/try argument.", filename, linenum);
|
+ fatal("%.200s line %d: Bad never/hard/demand/alow/try argument.", filename, linenum);
|
||||||
+ if (*intptr == -1)
|
+ if (*intptr == -1)
|
||||||
|
+ *intptr = value;
|
||||||
+ break;
|
+ break;
|
||||||
+
|
+
|
||||||
+ case lTLS_CaCertFile:
|
+ case lTLS_CaCertFile:
|
||||||
|
|
22
openssh.spec
22
openssh.spec
|
@ -64,7 +64,7 @@
|
||||||
|
|
||||||
# Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
|
# Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
|
||||||
%define openssh_ver 6.6.1p1
|
%define openssh_ver 6.6.1p1
|
||||||
%define openssh_rel 10
|
%define openssh_rel 11
|
||||||
%define pam_ssh_agent_ver 0.9.3
|
%define pam_ssh_agent_ver 0.9.3
|
||||||
%define pam_ssh_agent_rel 3
|
%define pam_ssh_agent_rel 3
|
||||||
|
|
||||||
|
@ -175,6 +175,9 @@ Patch713: openssh-6.6p1-ctr-cavstest.patch
|
||||||
Patch800: openssh-6.6p1-gsskex.patch
|
Patch800: openssh-6.6p1-gsskex.patch
|
||||||
#http://www.mail-archive.com/kerberos@mit.edu/msg17591.html
|
#http://www.mail-archive.com/kerberos@mit.edu/msg17591.html
|
||||||
Patch801: openssh-6.6p1-force_krb.patch
|
Patch801: openssh-6.6p1-force_krb.patch
|
||||||
|
# add new option GSSAPIEnablek5users and disable using ~/.k5users by default (#1169843)
|
||||||
|
# CVE-2014-9278
|
||||||
|
Patch802: openssh-6.6p1-GSSAPIEnablek5users.patch
|
||||||
Patch900: openssh-6.1p1-gssapi-canohost.patch
|
Patch900: openssh-6.1p1-gssapi-canohost.patch
|
||||||
#https://bugzilla.mindrot.org/show_bug.cgi?id=1780
|
#https://bugzilla.mindrot.org/show_bug.cgi?id=1780
|
||||||
Patch901: openssh-6.6p1-kuserok.patch
|
Patch901: openssh-6.6p1-kuserok.patch
|
||||||
|
@ -216,6 +219,10 @@ Patch916: openssh-6.6.1p1-selinux-contexts.patch
|
||||||
Patch917: openssh-6.6.1p1-cisco-dh-keys.patch
|
Patch917: openssh-6.6.1p1-cisco-dh-keys.patch
|
||||||
# log via monitor in chroots without /dev/log
|
# log via monitor in chroots without /dev/log
|
||||||
Patch918: openssh-6.6.1p1-log-in-chroot.patch
|
Patch918: openssh-6.6.1p1-log-in-chroot.patch
|
||||||
|
# scp file into non-existing directory (#1142223)
|
||||||
|
Patch919: openssh-6.6.1p1-scp-non-existing-directory.patch
|
||||||
|
# Config parser shouldn't accept ip/port syntax (#1130733)
|
||||||
|
Patch920: openssh-6.6.1p1-ip-port-config-parser.patch
|
||||||
|
|
||||||
License: BSD
|
License: BSD
|
||||||
Group: Applications/Internet
|
Group: Applications/Internet
|
||||||
|
@ -427,6 +434,9 @@ popd
|
||||||
%patch916 -p1 -b .contexts
|
%patch916 -p1 -b .contexts
|
||||||
%patch917 -p1 -b .cisco-dh
|
%patch917 -p1 -b .cisco-dh
|
||||||
%patch918 -p1 -b .log-in-chroot
|
%patch918 -p1 -b .log-in-chroot
|
||||||
|
%patch919 -p1 -b .scp
|
||||||
|
%patch920 -p1 -b .config
|
||||||
|
%patch802 -p1 -b .GSSAPIEnablek5users
|
||||||
|
|
||||||
%patch200 -p1 -b .audit
|
%patch200 -p1 -b .audit
|
||||||
%patch201 -p1 -b .audit-fps
|
%patch201 -p1 -b .audit-fps
|
||||||
|
@ -487,7 +497,7 @@ fi
|
||||||
--with-default-path=/usr/local/bin:/usr/bin \
|
--with-default-path=/usr/local/bin:/usr/bin \
|
||||||
--with-superuser-path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin \
|
--with-superuser-path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin \
|
||||||
--with-privsep-path=%{_var}/empty/sshd \
|
--with-privsep-path=%{_var}/empty/sshd \
|
||||||
--enable-vendor-patchlevel="FC-%{version}-%{release}" \
|
--enable-vendor-patchlevel="FC-%{openssh_ver}-%{openssh_rel}" \
|
||||||
--disable-strip \
|
--disable-strip \
|
||||||
--without-zlib-version-check \
|
--without-zlib-version-check \
|
||||||
--with-ssl-engine \
|
--with-ssl-engine \
|
||||||
|
@ -741,6 +751,14 @@ getent passwd sshd >/dev/null || \
|
||||||
%endif
|
%endif
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Fri Dec 19 2014 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-11 + 0.9.3-3
|
||||||
|
- error message if scp when directory doesn't exist (#1142223)
|
||||||
|
- parsing configuration file values (#1130733)
|
||||||
|
- documentation in service and socket files for systemd (#1181593)
|
||||||
|
- updated ldap patch (#981058)
|
||||||
|
- fixed vendor-patchlevel
|
||||||
|
- add new option GSSAPIEnablek5users and disable using ~/.k5users by default CVE-2014-9278 (#1170745)
|
||||||
|
|
||||||
* Fri Dec 19 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-10 + 0.9.3-3
|
* Fri Dec 19 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-10 + 0.9.3-3
|
||||||
- log via monitor in chroots without /dev/log
|
- log via monitor in chroots without /dev/log
|
||||||
|
|
||||||
|
|
|
@ -1,5 +1,6 @@
|
||||||
[Unit]
|
[Unit]
|
||||||
Description=OpenSSH server daemon
|
Description=OpenSSH server daemon
|
||||||
|
Documentation=man:sshd(8) man:sshd_config(5)
|
||||||
After=network.target sshd-keygen.service
|
After=network.target sshd-keygen.service
|
||||||
Wants=sshd-keygen.service
|
Wants=sshd-keygen.service
|
||||||
|
|
||||||
|
|
|
@ -1,5 +1,6 @@
|
||||||
[Unit]
|
[Unit]
|
||||||
Description=OpenSSH Server Socket
|
Description=OpenSSH Server Socket
|
||||||
|
Documentation=man:sshd(8) man:sshd_config(5)
|
||||||
Conflicts=sshd.service
|
Conflicts=sshd.service
|
||||||
|
|
||||||
[Socket]
|
[Socket]
|
||||||
|
|
|
@ -1,5 +1,6 @@
|
||||||
[Unit]
|
[Unit]
|
||||||
Description=OpenSSH per-connection server daemon
|
Description=OpenSSH per-connection server daemon
|
||||||
|
Documentation=man:sshd(8) man:sshd_config(5)
|
||||||
Wants=sshd-keygen.service
|
Wants=sshd-keygen.service
|
||||||
After=sshd-keygen.service
|
After=sshd-keygen.service
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue