From 71a006277a1ca4e4fb0bdb82e6155e235c7aa361 Mon Sep 17 00:00:00 2001 From: Jan F Date: Wed, 15 Sep 2010 20:04:07 +0200 Subject: [PATCH] - Add the GSSAPI kuserok switch to the kuserok patch --- openssh-5.5p1-kuserok.patch | 36 ++++++++++++++++++++++++++++++++++++ openssh.spec | 6 +++++- 2 files changed, 41 insertions(+), 1 deletion(-) diff --git a/openssh-5.5p1-kuserok.patch b/openssh-5.5p1-kuserok.patch index 2390745..3fd48e5 100644 --- a/openssh-5.5p1-kuserok.patch +++ b/openssh-5.5p1-kuserok.patch @@ -130,3 +130,39 @@ diff -up openssh-5.5p1/sshd_config.kuserok openssh-5.5p1/sshd_config # GSSAPI options #GSSAPIAuthentication no +diff -up openssh-5.6p1/gss-serv-krb5.c.kuserok openssh-5.6p1/gss-serv-krb5.c +--- openssh-5.6p1/gss-serv-krb5.c.kuserok 2010-09-15 15:39:48.000000000 +0200 ++++ openssh-5.6p1/gss-serv-krb5.c 2010-09-15 15:49:43.000000000 +0200 +@@ -97,13 +97,25 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client + krb5_get_err_text(krb_context, retval)); + return 0; + } +- if (krb5_kuserok(krb_context, princ, name)) { +- retval = 1; +- logit("Authorized to %s, krb5 principal %s (krb5_kuserok)", +- name, (char *)client->displayname.value); +- } else +- retval = 0; +- ++ if (options.use_kuserok) { ++ if (krb5_kuserok(krb_context, princ, name)) { ++ retval = 1; ++ logit("Authorized to %s, krb5 principal %s (krb5_kuserok)", ++ name, (char *)client->displayname.value); ++ } else ++ retval = 0; ++ } else { ++ char kuser[65]; ++ if (krb5_aname_to_localname(krb_context, princ, sizeof(kuser), kuser)) ++ retval = 0; ++ else if (strcmp(kuser, client)) ++ retval = 0; ++ else { ++ retval = 1; ++ logit("Authorized to %s, krb5 principal %s (krb5)", ++ name, (char *)client->displayname.value); ++ } ++ } + krb5_free_principal(krb_context, princ); + return retval; + } diff --git a/openssh.spec b/openssh.spec index dcd4280..f8ee64b 100644 --- a/openssh.spec +++ b/openssh.spec @@ -70,7 +70,7 @@ %endif # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1 -%define openssh_rel 20 +%define openssh_rel 21 %define openssh_ver 5.5p1 %define pam_ssh_agent_rel 26 %define pam_ssh_agent_ver 0.9.2 @@ -131,6 +131,7 @@ Patch74: openssh-5.3p1-randclean.patch Patch76: openssh-5.5p1-staterr.patch #https://bugzilla.mindrot.org/show_bug.cgi?id=1750 Patch77: openssh-5.5p1-stderr.patch +#https://bugzilla.mindrot.org/show_bug.cgi?id=1780 Patch78: openssh-5.5p1-kuserok.patch Patch79: openssh-5.5p1-x11.patch @@ -588,6 +589,9 @@ fi %endif %changelog +* Wed Sep 15 2010 Jan F. Chadima - 5.5p1-21 + 0.9.2-26 +- Add the GSSAPI kuserok switch to the kuserok patch + * Mon Sep 13 2010 Jan F. Chadima - 5.5p1-20 + 0.9.2-26 - Tweaking selabel patch to work properly without selinux rules loaded. (#632914) - enabling authorized keys command patch