* Drop unaccepted (unapplying) coverity patches * Drop server support for SSH1 (server) * Workaround #2641 for systemd * UseLogin is gone * Drop upstream commit 28652bca * Tighten seccomp filter (cache credentials before entering sandbox) (#1395288)
132 lines
5.4 KiB
Diff
132 lines
5.4 KiB
Diff
diff -up openssh-7.4p1/gss-serv-krb5.c.GSSAPIEnablek5users openssh-7.4p1/gss-serv-krb5.c
|
|
--- openssh-7.4p1/gss-serv-krb5.c.GSSAPIEnablek5users 2016-12-23 15:18:40.615216100 +0100
|
|
+++ openssh-7.4p1/gss-serv-krb5.c 2016-12-23 15:18:40.628216102 +0100
|
|
@@ -279,7 +279,6 @@ ssh_gssapi_krb5_cmdok(krb5_principal pri
|
|
FILE *fp;
|
|
char file[MAXPATHLEN];
|
|
char line[BUFSIZ] = "";
|
|
- char kuser[65]; /* match krb5_kuserok() */
|
|
struct stat st;
|
|
struct passwd *pw = the_authctxt->pw;
|
|
int found_principal = 0;
|
|
@@ -288,7 +287,7 @@ ssh_gssapi_krb5_cmdok(krb5_principal pri
|
|
|
|
snprintf(file, sizeof(file), "%s/.k5users", pw->pw_dir);
|
|
/* If both .k5login and .k5users DNE, self-login is ok. */
|
|
- if (!k5login_exists && (access(file, F_OK) == -1)) {
|
|
+ if ( !options.enable_k5users || (!k5login_exists && (access(file, F_OK) == -1))) {
|
|
return ssh_krb5_kuserok(krb_context, principal, luser,
|
|
k5login_exists);
|
|
}
|
|
diff -up openssh-7.4p1/servconf.c.GSSAPIEnablek5users openssh-7.4p1/servconf.c
|
|
--- openssh-7.4p1/servconf.c.GSSAPIEnablek5users 2016-12-23 15:18:40.615216100 +0100
|
|
+++ openssh-7.4p1/servconf.c 2016-12-23 15:35:36.354401156 +0100
|
|
@@ -168,6 +168,7 @@ initialize_server_options(ServerOptions
|
|
options->fingerprint_hash = -1;
|
|
options->disable_forwarding = -1;
|
|
options->use_kuserok = -1;
|
|
+ options->enable_k5users = -1;
|
|
}
|
|
|
|
/* Returns 1 if a string option is unset or set to "none" or 0 otherwise. */
|
|
@@ -345,6 +346,8 @@ fill_default_server_options(ServerOption
|
|
options->disable_forwarding = 0;
|
|
if (options->use_kuserok == -1)
|
|
options->use_kuserok = 1;
|
|
+ if (options->enable_k5users == -1)
|
|
+ options->enable_k5users = 0;
|
|
|
|
assemble_algorithms(options);
|
|
|
|
@@ -418,7 +421,7 @@ typedef enum {
|
|
sHostbasedUsesNameFromPacketOnly, sHostbasedAcceptedKeyTypes,
|
|
sHostKeyAlgorithms,
|
|
sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile,
|
|
- sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor,
|
|
+ sGssAuthentication, sGssCleanupCreds, sGssEnablek5users, sGssStrictAcceptor,
|
|
sGssKeyEx, sGssStoreRekey, sAcceptEnv, sPermitTunnel,
|
|
sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
|
|
sUsePrivilegeSeparation, sAllowAgentForwarding,
|
|
@@ -497,12 +500,14 @@ static struct {
|
|
{ "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL },
|
|
{ "gssapikeyexchange", sGssKeyEx, SSHCFG_GLOBAL },
|
|
{ "gssapistorecredentialsonrekey", sGssStoreRekey, SSHCFG_GLOBAL },
|
|
+ { "gssapienablek5users", sGssEnablek5users, SSHCFG_ALL },
|
|
#else
|
|
{ "gssapiauthentication", sUnsupported, SSHCFG_ALL },
|
|
{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
|
|
{ "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL },
|
|
{ "gssapikeyexchange", sUnsupported, SSHCFG_GLOBAL },
|
|
{ "gssapistorecredentialsonrekey", sUnsupported, SSHCFG_GLOBAL },
|
|
+ { "gssapienablek5users", sUnsupported, SSHCFG_ALL },
|
|
#endif
|
|
{ "gssusesessionccache", sUnsupported, SSHCFG_GLOBAL },
|
|
{ "gssapiusesessioncredcache", sUnsupported, SSHCFG_GLOBAL },
|
|
@@ -1653,6 +1658,10 @@ process_server_config_line(ServerOptions
|
|
intptr = &options->use_kuserok;
|
|
goto parse_flag;
|
|
|
|
+ case sGssEnablek5users:
|
|
+ intptr = &options->enable_k5users;
|
|
+ goto parse_flag;
|
|
+
|
|
case sPermitOpen:
|
|
arg = strdelim(&cp);
|
|
if (!arg || *arg == '\0')
|
|
@@ -2026,6 +2035,7 @@ copy_set_server_options(ServerOptions *d
|
|
M_CP_INTOPT(ip_qos_interactive);
|
|
M_CP_INTOPT(ip_qos_bulk);
|
|
M_CP_INTOPT(use_kuserok);
|
|
+ M_CP_INTOPT(enable_k5users);
|
|
M_CP_INTOPT(rekey_limit);
|
|
M_CP_INTOPT(rekey_interval);
|
|
|
|
@@ -2320,6 +2330,7 @@ dump_config(ServerOptions *o)
|
|
dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
|
|
dump_cfg_fmtint(sFingerprintHash, o->fingerprint_hash);
|
|
dump_cfg_fmtint(sKerberosUseKuserok, o->use_kuserok);
|
|
+ dump_cfg_fmtint(sGssEnablek5users, o->enable_k5users);
|
|
|
|
/* string arguments */
|
|
dump_cfg_string(sPidFile, o->pid_file);
|
|
diff -up openssh-7.4p1/servconf.h.GSSAPIEnablek5users openssh-7.4p1/servconf.h
|
|
--- openssh-7.4p1/servconf.h.GSSAPIEnablek5users 2016-12-23 15:18:40.616216100 +0100
|
|
+++ openssh-7.4p1/servconf.h 2016-12-23 15:18:40.629216102 +0100
|
|
@@ -174,7 +174,8 @@ typedef struct {
|
|
|
|
int num_permitted_opens;
|
|
|
|
- int use_kuserok;
|
|
+ int use_kuserok;
|
|
+ int enable_k5users;
|
|
char *chroot_directory;
|
|
char *revoked_keys_file;
|
|
char *trusted_user_ca_keys;
|
|
diff -up openssh-7.4p1/sshd_config.5.GSSAPIEnablek5users openssh-7.4p1/sshd_config.5
|
|
--- openssh-7.4p1/sshd_config.5.GSSAPIEnablek5users 2016-12-23 15:18:40.630216103 +0100
|
|
+++ openssh-7.4p1/sshd_config.5 2016-12-23 15:36:21.607408435 +0100
|
|
@@ -628,6 +628,12 @@ Specifies whether to automatically destr
|
|
on logout.
|
|
The default is
|
|
.Cm yes .
|
|
+.It Cm GSSAPIEnablek5users
|
|
+Specifies whether to look at .k5users file for GSSAPI authentication
|
|
+access control. Further details are described in
|
|
+.Xr ksu 1 .
|
|
+The default is
|
|
+.Cm no .
|
|
.It Cm GSSAPIKeyExchange
|
|
Specifies whether key exchange based on GSSAPI is allowed. GSSAPI key exchange
|
|
doesn't rely on ssh keys to verify host identity.
|
|
diff -up openssh-7.4p1/sshd_config.GSSAPIEnablek5users openssh-7.4p1/sshd_config
|
|
--- openssh-7.4p1/sshd_config.GSSAPIEnablek5users 2016-12-23 15:18:40.616216100 +0100
|
|
+++ openssh-7.4p1/sshd_config 2016-12-23 15:18:40.631216103 +0100
|
|
@@ -80,6 +80,7 @@ GSSAPIAuthentication yes
|
|
GSSAPICleanupCredentials no
|
|
#GSSAPIStrictAcceptorCheck yes
|
|
#GSSAPIKeyExchange no
|
|
+#GSSAPIEnablek5users no
|
|
|
|
# Set this to 'yes' to enable PAM authentication, account processing,
|
|
# and session processing. If this is enabled, PAM authentication will
|