- Add the GSSAPI kuserok switch to the kuserok patch
This commit is contained in:
parent
a3a0ece415
commit
71a006277a
|
@ -130,3 +130,39 @@ diff -up openssh-5.5p1/sshd_config.kuserok openssh-5.5p1/sshd_config
|
||||||
|
|
||||||
# GSSAPI options
|
# GSSAPI options
|
||||||
#GSSAPIAuthentication no
|
#GSSAPIAuthentication no
|
||||||
|
diff -up openssh-5.6p1/gss-serv-krb5.c.kuserok openssh-5.6p1/gss-serv-krb5.c
|
||||||
|
--- openssh-5.6p1/gss-serv-krb5.c.kuserok 2010-09-15 15:39:48.000000000 +0200
|
||||||
|
+++ openssh-5.6p1/gss-serv-krb5.c 2010-09-15 15:49:43.000000000 +0200
|
||||||
|
@@ -97,13 +97,25 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client
|
||||||
|
krb5_get_err_text(krb_context, retval));
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
- if (krb5_kuserok(krb_context, princ, name)) {
|
||||||
|
- retval = 1;
|
||||||
|
- logit("Authorized to %s, krb5 principal %s (krb5_kuserok)",
|
||||||
|
- name, (char *)client->displayname.value);
|
||||||
|
- } else
|
||||||
|
- retval = 0;
|
||||||
|
-
|
||||||
|
+ if (options.use_kuserok) {
|
||||||
|
+ if (krb5_kuserok(krb_context, princ, name)) {
|
||||||
|
+ retval = 1;
|
||||||
|
+ logit("Authorized to %s, krb5 principal %s (krb5_kuserok)",
|
||||||
|
+ name, (char *)client->displayname.value);
|
||||||
|
+ } else
|
||||||
|
+ retval = 0;
|
||||||
|
+ } else {
|
||||||
|
+ char kuser[65];
|
||||||
|
+ if (krb5_aname_to_localname(krb_context, princ, sizeof(kuser), kuser))
|
||||||
|
+ retval = 0;
|
||||||
|
+ else if (strcmp(kuser, client))
|
||||||
|
+ retval = 0;
|
||||||
|
+ else {
|
||||||
|
+ retval = 1;
|
||||||
|
+ logit("Authorized to %s, krb5 principal %s (krb5)",
|
||||||
|
+ name, (char *)client->displayname.value);
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
krb5_free_principal(krb_context, princ);
|
||||||
|
return retval;
|
||||||
|
}
|
||||||
|
|
|
@ -70,7 +70,7 @@
|
||||||
%endif
|
%endif
|
||||||
|
|
||||||
# Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
|
# Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
|
||||||
%define openssh_rel 20
|
%define openssh_rel 21
|
||||||
%define openssh_ver 5.5p1
|
%define openssh_ver 5.5p1
|
||||||
%define pam_ssh_agent_rel 26
|
%define pam_ssh_agent_rel 26
|
||||||
%define pam_ssh_agent_ver 0.9.2
|
%define pam_ssh_agent_ver 0.9.2
|
||||||
|
@ -131,6 +131,7 @@ Patch74: openssh-5.3p1-randclean.patch
|
||||||
Patch76: openssh-5.5p1-staterr.patch
|
Patch76: openssh-5.5p1-staterr.patch
|
||||||
#https://bugzilla.mindrot.org/show_bug.cgi?id=1750
|
#https://bugzilla.mindrot.org/show_bug.cgi?id=1750
|
||||||
Patch77: openssh-5.5p1-stderr.patch
|
Patch77: openssh-5.5p1-stderr.patch
|
||||||
|
#https://bugzilla.mindrot.org/show_bug.cgi?id=1780
|
||||||
Patch78: openssh-5.5p1-kuserok.patch
|
Patch78: openssh-5.5p1-kuserok.patch
|
||||||
Patch79: openssh-5.5p1-x11.patch
|
Patch79: openssh-5.5p1-x11.patch
|
||||||
|
|
||||||
|
@ -588,6 +589,9 @@ fi
|
||||||
%endif
|
%endif
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Wed Sep 15 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-21 + 0.9.2-26
|
||||||
|
- Add the GSSAPI kuserok switch to the kuserok patch
|
||||||
|
|
||||||
* Mon Sep 13 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-20 + 0.9.2-26
|
* Mon Sep 13 2010 Jan F. Chadima <jchadima@redhat.com> - 5.5p1-20 + 0.9.2-26
|
||||||
- Tweaking selabel patch to work properly without selinux rules loaded. (#632914)
|
- Tweaking selabel patch to work properly without selinux rules loaded. (#632914)
|
||||||
- enabling authorized keys command patch
|
- enabling authorized keys command patch
|
||||||
|
|
Loading…
Reference in New Issue