diff -ru openssh-3.0p1/CREDITS openssh-3.0.1p1/CREDITS --- openssh-3.0p1/CREDITS 2001-04-16 10:41:46.000000000 +1000 +++ openssh-3.0.1p1/CREDITS 2001-11-12 10:34:22.000000000 +1100 @@ -54,6 +54,7 @@ Larry Jones - Bugfixes Lutz Jaenicke - Bugfixes Marc G. Fournier - Solaris patches +Mark D. Baushke - bug fixes Martin Johansson - Linux fixes Mark D. Roth - Features, bug fixes Mark Miller - Bugfixes @@ -88,5 +89,5 @@ Damien Miller -$Id: CREDITS,v 1.62 2001/04/16 00:41:46 djm Exp $ +$Id: CREDITS,v 1.63 2001/11/11 23:34:22 djm Exp $ diff -ru openssh-3.0p1/ChangeLog openssh-3.0.1p1/ChangeLog --- openssh-3.0p1/ChangeLog 2001-11-04 06:09:32.000000000 +1100 +++ openssh-3.0.1p1/ChangeLog 2001-11-15 23:16:50.000000000 +1100 @@ -1,3 +1,114 @@ +20011115 + - (djm) Fix IPv4 default in ssh-keyscan. Spotted by Dan Astoorian + Fix from markus@ + - (djm) Release 3.0.1p1 + +20011113 + - (djm) Fix early (and double) free of remote user when using Kerberos. + Patch from Simon Wilkinson + - (djm) AIX login{success,failed} changes. Move loginsuccess call to + do_authenticated. Call loginfailed for protocol 2 failures > MAX like + we do for protocol 1. Reports from Ralf Wenk , + K.Wolkersdorfer@fz-juelich.de and others + - (djm) OpenBSD CVS Sync + - dugsong@cvs.openbsd.org 2001/11/11 18:47:10 + [auth-krb5.c] + fix krb5 authorization check. found by . from + art@, deraadt@ ok + - markus@cvs.openbsd.org 2001/11/12 11:17:07 + [servconf.c] + enable authorized_keys2 again. tested by fries@ + - markus@cvs.openbsd.org 2001/11/13 02:03:57 + [version.h] + enter 3.0.1 + - (djm) Bump RPM package versions + +20011112 + - (djm) Makefile correctness fix from Mark D. Baushke + - (djm) Cygwin config patch from Corinna Vinschen + - OpenBSD CVS Sync + - markus@cvs.openbsd.org 2001/10/24 08:41:41 + [sshd.c] + mention remote port in debug message + - markus@cvs.openbsd.org 2001/10/24 08:41:20 + [ssh.c] + remove unused + - markus@cvs.openbsd.org 2001/10/24 08:51:35 + [clientloop.c ssh.c] + ignore SIGPIPE early, makes ssh work if agent dies, netbsd-pr via itojun@ + - markus@cvs.openbsd.org 2001/10/24 19:57:40 + [clientloop.c] + make ~& (backgrounding) work again for proto v1; add support ~& for v2, too + - markus@cvs.openbsd.org 2001/10/25 21:14:32 + [ssh-keygen.1 ssh-keygen.c] + better docu for fingerprinting, ok deraadt@ + - markus@cvs.openbsd.org 2001/10/29 19:27:15 + [sshconnect2.c] + hostbased: check for client hostkey before building chost + - markus@cvs.openbsd.org 2001/10/30 20:29:09 + [ssh.1] + ssh.1 + - markus@cvs.openbsd.org 2001/11/07 16:03:17 + [packet.c packet.h sshconnect2.c] + pad using the padding field from the ssh2 packet instead of sending + extra ignore messages. tested against several other ssh servers. + - markus@cvs.openbsd.org 2001/11/07 21:40:21 + [ssh-rsa.c] + ssh_rsa_sign/verify: SSH_BUG_SIGBLOB not supported + - markus@cvs.openbsd.org 2001/11/07 22:10:28 + [ssh-dss.c ssh-rsa.c] + missing free and sync dss/rsa code. + - markus@cvs.openbsd.org 2001/11/07 22:12:01 + [sshd.8] + s/Keepalive/KeepAlive/; from openbsd@davidkrause.com + - markus@cvs.openbsd.org 2001/11/07 22:41:51 + [auth2.c auth-rh-rsa.c] + unused includes + - markus@cvs.openbsd.org 2001/11/07 22:53:21 + [channels.h] + crank c->path to 256 so they can hold a full hostname; dwd@bell-labs.com + - markus@cvs.openbsd.org 2001/11/08 10:51:08 + [readpass.c] + don't strdup too much data; from gotoh@taiyo.co.jp; ok millert. + - markus@cvs.openbsd.org 2001/11/08 17:49:53 + [ssh.1] + mention setuid root requirements; noted by cnorris@csc.UVic.ca; ok stevesk@ + - markus@cvs.openbsd.org 2001/11/08 20:02:24 + [auth.c] + don't print ROOT in CAPS for the authentication messages, i.e. + Accepted publickey for ROOT from 127.0.0.1 port 42734 ssh2 + becomes + Accepted publickey for root from 127.0.0.1 port 42734 ssh2 + - markus@cvs.openbsd.org 2001/11/09 18:59:23 + [clientloop.c serverloop.c] + don't memset too much memory, ok millert@ + original patch from jlk@kamens.brookline.ma.us via nalin@redhat.com + - markus@cvs.openbsd.org 2001/11/10 13:19:45 + [sshd.c] + cleanup libwrap support (remove bogus comment, bogus close(), add + debug, etc). + - markus@cvs.openbsd.org 2001/11/10 13:22:42 + [ssh-rsa.c] + KNF (unexpand) + - markus@cvs.openbsd.org 2001/11/10 13:37:20 + [packet.c] + remove extra debug() + - markus@cvs.openbsd.org 2001/11/11 13:02:31 + [servconf.c] + make AuthorizedKeysFile2 fallback to AuthorizedKeysFile if + AuthorizedKeysFile is specified. + - (djm) Reorder portable-specific server options so that they come first. + This should help reduce diff collisions for new server options (as they + will appear at the end) + +20011109 + - (stevesk) auth-pam.c: use do_pam_authenticate(PAM_DISALLOW_NULL_AUTHTOK) + if permit_empty_passwd == 0 so null password check cannot be bypassed. + jayaraj@amritapuri.com OpenBSD bug 2168 + - markus@cvs.openbsd.org 2001/11/09 19:08:35 + [sshd.c] + remove extra trailing dot from log message; pilot@naughty.monkey.org + 20011103 - (tim) [ contrib/caldera/openssh.spec contrib/caldera/sshd.init] Updates from Raymund Will @@ -6801,4 +6912,4 @@ - Wrote replacements for strlcpy and mkdtemp - Released 1.0pre1 -$Id: ChangeLog,v 1.1631 2001/11/03 19:09:32 tim Exp $ +$Id: ChangeLog,v 1.1665 2001/11/15 12:16:50 djm Exp $ diff -ru openssh-3.0p1/Makefile.in openssh-3.0.1p1/Makefile.in --- openssh-3.0p1/Makefile.in 2001-10-22 10:53:59.000000000 +1000 +++ openssh-3.0.1p1/Makefile.in 2001-11-12 10:34:23.000000000 +1100 @@ -1,4 +1,4 @@ -# $Id: Makefile.in,v 1.189 2001/10/22 00:53:59 tim Exp $ +# $Id: Makefile.in,v 1.190 2001/11/11 23:34:23 djm Exp $ prefix=@prefix@ exec_prefix=@exec_prefix@ @@ -87,7 +87,7 @@ LIBCOMPAT=openbsd-compat/libopenbsd-compat.a $(LIBCOMPAT): always - (cd openbsd-compat; $(MAKE)) + (cd openbsd-compat && $(MAKE)) always: libssh.a: $(LIBSSH_OBJS) @@ -144,23 +144,23 @@ clean: rm -f *.o *.a $(TARGETS) logintest config.cache config.log rm -f *.out core - (cd openbsd-compat; $(MAKE) clean) + (cd openbsd-compat && $(MAKE) clean) distclean: rm -f *.o *.a $(TARGETS) logintest config.cache config.log rm -f *.out core rm -f Makefile config.h config.status ssh_prng_cmds *~ rm -rf autom4te.cache - (cd openbsd-compat; $(MAKE) distclean) - (cd scard; $(MAKE) distclean) + (cd openbsd-compat && $(MAKE) distclean) + (cd scard && $(MAKE) distclean) veryclean: rm -f configure config.h.in *.0 rm -f *.o *.a $(TARGETS) logintest config.cache config.log rm -f *.out core rm -f Makefile config.h config.status ssh_prng_cmds *~ - (cd openbsd-compat; $(MAKE) distclean) - (cd scard; $(MAKE) distclean) + (cd openbsd-compat && $(MAKE) distclean) + (cd scard && $(MAKE) distclean) mrproper: distclean @@ -174,13 +174,13 @@ distprep: catman-do autoreconf - (cd scard ; $(MAKE) -f Makefile.in distprep) + (cd scard && $(MAKE) -f Makefile.in distprep) install: $(CONFIGFILES) $(MANPAGES) $(TARGETS) install-files host-key install-nokeys: $(CONFIGFILES) $(MANPAGES) $(TARGETS) install-files scard-install: - (cd scard; $(MAKE) DESTDIR=$(DESTDIR) install) + (cd scard && $(MAKE) DESTDIR=$(DESTDIR) install) install-files: scard-install $(srcdir)/mkinstalldirs $(DESTDIR)$(bindir) diff -ru openssh-3.0p1/auth-krb5.c openssh-3.0.1p1/auth-krb5.c --- openssh-3.0p1/auth-krb5.c 2001-09-25 12:58:24.000000000 +1000 +++ openssh-3.0.1p1/auth-krb5.c 2001-11-14 00:02:11.000000000 +1100 @@ -2,7 +2,7 @@ * Kerberos v5 authentication and ticket-passing routines. * * $FreeBSD: src/crypto/openssh/auth-krb5.c,v 1.6 2001/02/13 16:58:04 assar Exp $ - * $OpenBSD: auth-krb5.c,v 1.1 2001/06/26 16:15:23 dugsong Exp $ + * $OpenBSD: auth-krb5.c,v 1.2 2001/11/12 01:47:09 dugsong Exp $ */ #include "includes.h" @@ -52,8 +52,9 @@ krb5_principal server; krb5_data reply; krb5_ticket *ticket; - int fd; - + int fd, ret; + + ret = 0; server = NULL; ticket = NULL; reply.length = 0; @@ -107,7 +108,8 @@ packet_put_string((char *) reply.data, reply.length); packet_send(); packet_write_wait(); - + + ret = 1; err: if (server) krb5_free_principal(authctxt->krb5_ctx, server); @@ -116,12 +118,11 @@ if (reply.length) xfree(reply.data); - if (problem) { + if (problem) debug("Kerberos v5 authentication failed: %s", krb5_get_err_text(authctxt->krb5_ctx, problem)); - return (0); - } - return (1); + + return (ret); } int diff -ru openssh-3.0p1/auth-pam.c openssh-3.0.1p1/auth-pam.c --- openssh-3.0p1/auth-pam.c 2001-10-29 04:32:38.000000000 +1100 +++ openssh-3.0.1p1/auth-pam.c 2001-11-10 07:22:17.000000000 +1100 @@ -35,7 +35,7 @@ extern char *__progname; -RCSID("$Id: auth-pam.c,v 1.40 2001/10/28 17:32:38 stevesk Exp $"); +RCSID("$Id: auth-pam.c,v 1.41 2001/11/09 20:22:17 stevesk Exp $"); #define NEW_AUTHTOK_MSG \ "Warning: Your password has expired, please change it now" @@ -217,7 +217,8 @@ __pampasswd = password; pamstate = INITIAL_LOGIN; - pam_retval = do_pam_authenticate(0); + pam_retval = do_pam_authenticate( + options.permit_empty_passwd == 0 ? PAM_DISALLOW_NULL_AUTHTOK : 0); if (pam_retval == PAM_SUCCESS) { debug("PAM Password authentication accepted for " "user \"%.100s\"", pw->pw_name); diff -ru openssh-3.0p1/auth-rh-rsa.c openssh-3.0.1p1/auth-rh-rsa.c --- openssh-3.0p1/auth-rh-rsa.c 2001-06-25 14:40:49.000000000 +1000 +++ openssh-3.0.1p1/auth-rh-rsa.c 2001-11-12 11:04:28.000000000 +1100 @@ -13,7 +13,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: auth-rh-rsa.c,v 1.25 2001/06/23 03:04:42 markus Exp $"); +RCSID("$OpenBSD: auth-rh-rsa.c,v 1.26 2001/11/07 22:41:51 markus Exp $"); #include "packet.h" #include "xmalloc.h" @@ -24,7 +24,6 @@ #include "hostfile.h" #include "pathnames.h" #include "auth.h" -#include "tildexpand.h" #include "canohost.h" /* diff -ru openssh-3.0p1/auth.c openssh-3.0.1p1/auth.c --- openssh-3.0p1/auth.c 2001-10-04 03:55:27.000000000 +1000 +++ openssh-3.0.1p1/auth.c 2001-11-12 11:06:07.000000000 +1100 @@ -23,7 +23,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: auth.c,v 1.28 2001/10/03 10:01:20 markus Exp $"); +RCSID("$OpenBSD: auth.c,v 1.29 2001/11/08 20:02:24 markus Exp $"); #ifdef HAVE_LOGIN_H #include @@ -208,7 +208,7 @@ authmsg, method, authctxt->valid ? "" : "illegal user ", - authctxt->valid && authctxt->pw->pw_uid == 0 ? "ROOT" : authctxt->user, + authctxt->user, get_remote_ipaddr(), get_remote_port(), info); diff -ru openssh-3.0p1/auth1.c openssh-3.0.1p1/auth1.c --- openssh-3.0p1/auth1.c 2001-07-04 14:21:16.000000000 +1000 +++ openssh-3.0.1p1/auth1.c 2001-11-13 23:46:19.000000000 +1100 @@ -29,10 +29,6 @@ /* import */ extern ServerOptions options; -#ifdef WITH_AIXAUTHENTICATE -extern char *aixloginmsg; -#endif /* WITH_AIXAUTHENTICATE */ - /* * convert ssh auth msg type into description */ @@ -140,7 +136,6 @@ snprintf(info, sizeof(info), " tktuser %.100s", client_user); - xfree(client_user); } #endif /* KRB4 */ } else { @@ -154,7 +149,6 @@ snprintf(info, sizeof(info), " tktuser %.100s", client_user); - xfree(client_user); } #endif /* KRB5 */ } @@ -430,14 +424,6 @@ packet_send(); packet_write_wait(); -#ifdef WITH_AIXAUTHENTICATE - /* We don't have a pty yet, so just label the line as "ssh" */ - if (loginsuccess(authctxt->user, - get_canonical_hostname(options.reverse_mapping_check), - "ssh", &aixloginmsg) < 0) - aixloginmsg = NULL; -#endif /* WITH_AIXAUTHENTICATE */ - /* Perform session preparation. */ do_authenticated(authctxt); } diff -ru openssh-3.0p1/auth2.c openssh-3.0.1p1/auth2.c --- openssh-3.0p1/auth2.c 2001-10-04 03:12:44.000000000 +1000 +++ openssh-3.0.1p1/auth2.c 2001-11-13 23:46:19.000000000 +1100 @@ -23,7 +23,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: auth2.c,v 1.71 2001/09/27 15:31:17 markus Exp $"); +RCSID("$OpenBSD: auth2.c,v 1.72 2001/11/07 22:41:51 markus Exp $"); #include @@ -50,7 +50,6 @@ #include "misc.h" #include "hostfile.h" #include "canohost.h" -#include "tildexpand.h" #include "match.h" /* import */ @@ -58,10 +57,6 @@ extern u_char *session_id2; extern int session_id2_len; -#ifdef WITH_AIXAUTHENTICATE -extern char *aixloginmsg; -#endif - static Authctxt *x_authctxt = NULL; static int one = 1; @@ -283,8 +278,14 @@ /* now we can break out */ authctxt->success = 1; } else { - if (authctxt->failures++ > AUTH_FAIL_MAX) + if (authctxt->failures++ > AUTH_FAIL_MAX) { +#ifdef WITH_AIXAUTHENTICATE + loginfailed(authctxt->user, + get_canonical_hostname(options.reverse_mapping_check), + "ssh"); +#endif /* WITH_AIXAUTHENTICATE */ packet_disconnect(AUTH_FAIL_MSG, authctxt->user); + } methods = authmethods_get(); packet_start(SSH2_MSG_USERAUTH_FAILURE); packet_put_cstring(methods); diff -ru openssh-3.0p1/channels.h openssh-3.0.1p1/channels.h --- openssh-3.0p1/channels.h 2001-10-12 11:35:06.000000000 +1000 +++ openssh-3.0.1p1/channels.h 2001-11-12 11:04:55.000000000 +1100 @@ -32,7 +32,7 @@ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ -/* RCSID("$OpenBSD: channels.h,v 1.50 2001/10/10 22:18:47 markus Exp $"); */ +/* RCSID("$OpenBSD: channels.h,v 1.51 2001/11/07 22:53:21 markus Exp $"); */ #ifndef CHANNEL_H #define CHANNEL_H @@ -56,7 +56,7 @@ #define SSH_CHANNEL_ZOMBIE 14 /* Almost dead. */ #define SSH_CHANNEL_MAX_TYPE 15 -#define SSH_CHANNEL_PATH_LEN 30 +#define SSH_CHANNEL_PATH_LEN 256 struct Channel; typedef struct Channel Channel; diff -ru openssh-3.0p1/clientloop.c openssh-3.0.1p1/clientloop.c --- openssh-3.0p1/clientloop.c 2001-10-12 11:36:09.000000000 +1000 +++ openssh-3.0.1p1/clientloop.c 2001-11-12 11:06:33.000000000 +1100 @@ -59,7 +59,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: clientloop.c,v 1.84 2001/10/11 15:24:00 markus Exp $"); +RCSID("$OpenBSD: clientloop.c,v 1.87 2001/11/09 18:59:23 markus Exp $"); #include "ssh.h" #include "ssh1.h" @@ -346,8 +346,8 @@ if (session_closed && !channel_still_open() && !packet_have_data_to_write()) { /* clear mask since we did not call select() */ - memset(*readsetp, 0, *maxfdp); - memset(*writesetp, 0, *maxfdp); + memset(*readsetp, 0, *nallocp); + memset(*writesetp, 0, *nallocp); return; } else { FD_SET(connection_in, *readsetp); @@ -375,8 +375,8 @@ * We have to return, because the mainloop checks for the flags * set by the signal handlers. */ - memset(*readsetp, 0, *maxfdp); - memset(*writesetp, 0, *maxfdp); + memset(*readsetp, 0, *nallocp); + memset(*writesetp, 0, *nallocp); if (errno == EINTR) return; @@ -522,36 +522,19 @@ continue; case '&': - /* XXX does not work yet with proto 2 */ - if (compat20) - continue; /* * Detach the program (continue to serve connections, * but put in background and no more new connections). */ - if (!stdin_eof) { - /* - * Sending SSH_CMSG_EOF alone does not always appear - * to be enough. So we try to send an EOF character - * first. - */ - packet_start(SSH_CMSG_STDIN_DATA); - packet_put_string("\004", 1); - packet_send(); - /* Close stdin. */ - stdin_eof = 1; - if (buffer_len(bin) == 0) { - packet_start(SSH_CMSG_EOF); - packet_send(); - } - } /* Restore tty modes. */ leave_raw_mode(); /* Stop listening for new connections. */ - channel_close_all(); /* proto1 only XXXX */ + channel_stop_listening(); - printf("%c& [backgrounded]\n", escape_char); + snprintf(string, sizeof string, + "%c& [backgrounded]\n", escape_char); + buffer_append(berr, string, strlen(string)); /* Fork into background. */ pid = fork(); @@ -564,7 +547,27 @@ exit(0); } /* The child continues serving connections. */ - continue; /*XXX ? */ + if (compat20) { + buffer_append(bin, "\004", 1); + /* fake EOF on stdin */ + return -1; + } else if (!stdin_eof) { + /* + * Sending SSH_CMSG_EOF alone does not always appear + * to be enough. So we try to send an EOF character + * first. + */ + packet_start(SSH_CMSG_STDIN_DATA); + packet_put_string("\004", 1); + packet_send(); + /* Close stdin. */ + stdin_eof = 1; + if (buffer_len(bin) == 0) { + packet_start(SSH_CMSG_EOF); + packet_send(); + } + } + continue; case '?': snprintf(string, sizeof string, @@ -820,7 +823,6 @@ signal(SIGINT, signal_handler); signal(SIGQUIT, signal_handler); signal(SIGTERM, signal_handler); - signal(SIGPIPE, SIG_IGN); if (have_pty) signal(SIGWINCH, window_change_handler); diff -ru openssh-3.0p1/contrib/caldera/openssh.spec openssh-3.0.1p1/contrib/caldera/openssh.spec --- openssh-3.0p1/contrib/caldera/openssh.spec 2001-11-04 06:09:33.000000000 +1100 +++ openssh-3.0.1p1/contrib/caldera/openssh.spec 2001-11-14 00:05:58.000000000 +1100 @@ -1,6 +1,6 @@ %define use-stable 1 %if %{use-stable} - %define version 3.0p1 + %define version 3.0.1p1 %define cvs %{nil} %define release 1 %else @@ -224,4 +224,4 @@ %ChangeLog * Mon Jan 01 1998 ... -$Id: openssh.spec,v 1.24 2001/11/03 19:09:33 tim Exp $ +$Id: openssh.spec,v 1.25 2001/11/13 13:05:58 djm Exp $ diff -ru openssh-3.0p1/contrib/cygwin/ssh-host-config openssh-3.0.1p1/contrib/cygwin/ssh-host-config --- openssh-3.0p1/contrib/cygwin/ssh-host-config 2001-07-19 02:25:42.000000000 +1000 +++ openssh-3.0.1p1/contrib/cygwin/ssh-host-config 2001-11-12 10:36:21.000000000 +1100 @@ -98,7 +98,7 @@ echo echo "There are still ssh processes running. Please shut them down first." echo - exit 1 + #exit 1 fi # Check for ${SYSCONFDIR} directory @@ -234,9 +234,9 @@ # Site-wide defaults for various options # Host * -# ForwardAgent yes -# ForwardX11 yes -# RhostsAuthentication yes +# ForwardAgent no +# ForwardX11 no +# RhostsAuthentication no # RhostsRSAAuthentication yes # RSAAuthentication yes # PasswordAuthentication yes @@ -244,22 +244,14 @@ # UseRsh no # BatchMode no # CheckHostIP yes -# StrictHostKeyChecking no +# StrictHostKeyChecking yes +# IdentityFile ~/.ssh/identity +# IdentityFile ~/.ssh/id_dsa +# IdentityFile ~/.ssh/id_rsa # Port 22 # Protocol 2,1 -# Cipher 3des +# Cipher blowfish # EscapeChar ~ - -# Be paranoid by default -Host * - ForwardAgent no - ForwardX11 no - FallBackToRsh no - -# Try authentification with the following identities - IdentityFile ~/.ssh/identity - IdentityFile ~/.ssh/id_rsa - IdentityFile ~/.ssh/id_dsa EOF if [ "$port_number" != "22" ] then @@ -288,60 +280,69 @@ then echo "Generating ${SYSCONFDIR}/sshd_config file" cat > ${SYSCONFDIR}/sshd_config << EOF -# This is ssh server systemwide configuration file. +# This is the sshd server system-wide configuration file. See sshd(8) +# for more information. Port $port_number -# -Protocol 2,1 -ListenAddress 0.0.0.0 +#Protocol 2,1 +#ListenAddress 0.0.0.0 #ListenAddress :: -# -# Uncomment the following lines according to the used authentication + +# HostKey for protocol version 1 HostKey /etc/ssh_host_key +# HostKeys for protocol version 2 HostKey /etc/ssh_host_rsa_key HostKey /etc/ssh_host_dsa_key + +# Lifetime and size of ephemeral version 1 server ke +KeyRegenerationInterval 3600 ServerKeyBits 768 + +# Logging +SyslogFacility AUTH +LogLevel INFO +#obsoletes QuietMode and FascistLogging + +# Authentication: + LoginGraceTime 600 -KeyRegenerationInterval 3600 PermitRootLogin yes -# -# Don't read ~/.rhosts and ~/.shosts files -IgnoreRhosts yes -# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication -#IgnoreUserKnownHosts yes - -# # The following setting overrides permission checks on host key files # and directories. For security reasons set this to "yes" when running # NT/W2K, NTFS and CYGWIN=ntsec. StrictModes no -X11Forwarding no -X11DisplayOffset 10 -PrintMotd yes -KeepAlive yes - -# Logging -SyslogFacility AUTH -LogLevel INFO -#obsoletes QuietMode and FascistLogging +RSAAuthentication yes +PubkeyAuthentication yes +#AuthorizedKeysFile %h/.ssh/authorized_keys +# rhosts authentication should not be used RhostsAuthentication no -# +# Don't read ~/.rhosts and ~/.shosts files +IgnoreRhosts yes # For this to work you will also need host keys in /etc/ssh_known_hosts RhostsRSAAuthentication no +# similar for protocol version 2 +HostbasedAuthentication no +# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication +#IgnoreUserKnownHosts yes -RSAAuthentication yes - +# To disable tunneled clear text passwords, change to no here! PasswordAuthentication yes PermitEmptyPasswords no -CheckMail no -UseLogin no +X11Forwarding no +X11DisplayOffset 10 +PrintMotd yes +#PrintLastLog no +KeepAlive yes +#UseLogin no -#Uncomment if you want to enable sftp -#Subsystem sftp /usr/sbin/sftp-server #MaxStartups 10:30:60 +#Banner /etc/issue.net +#ReverseMappingCheck yes + +Subsystem sftp /usr/sbin/sftp-server EOF fi diff -ru openssh-3.0p1/contrib/redhat/openssh.spec openssh-3.0.1p1/contrib/redhat/openssh.spec --- openssh-3.0p1/contrib/redhat/openssh.spec 2001-10-31 10:31:14.000000000 +1100 +++ openssh-3.0.1p1/contrib/redhat/openssh.spec 2001-11-14 00:05:58.000000000 +1100 @@ -1,5 +1,5 @@ # Version of OpenSSH -%define oversion 3.0p1 +%define oversion 3.0.1p1 # Version of ssh-askpass %define aversion 1.2.4.1 diff -ru openssh-3.0p1/contrib/suse/openssh.spec openssh-3.0.1p1/contrib/suse/openssh.spec --- openssh-3.0p1/contrib/suse/openssh.spec 2001-10-25 07:06:08.000000000 +1000 +++ openssh-3.0.1p1/contrib/suse/openssh.spec 2001-11-14 00:05:58.000000000 +1100 @@ -1,6 +1,6 @@ Summary: OpenSSH, a free Secure Shell (SSH) protocol implementation Name: openssh -Version: 3.0p1 +Version: 3.0.1p1 URL: http://www.openssh.com/ Release: 1 Source0: openssh-%{version}.tar.gz diff -ru openssh-3.0p1/packet.c openssh-3.0.1p1/packet.c --- openssh-3.0p1/packet.c 2001-10-04 03:10:18.000000000 +1000 +++ openssh-3.0.1p1/packet.c 2001-11-12 11:07:58.000000000 +1100 @@ -37,7 +37,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: packet.c,v 1.70 2001/09/27 11:59:37 markus Exp $"); +RCSID("$OpenBSD: packet.c,v 1.72 2001/11/10 13:37:20 markus Exp $"); #include "xmalloc.h" #include "buffer.h" @@ -115,6 +115,9 @@ /* Session key information for Encryption and MAC */ Newkeys *newkeys[MODE_MAX]; +/* roundup current message to extra_pad bytes */ +static u_char extra_pad = 0; + /* * Sets the descriptors used for communication. Disables encryption until * packet_set_encryption_key is called. @@ -485,9 +488,10 @@ { static u_int32_t seqnr = 0; u_char type, *ucp, *macbuf = NULL; + u_char padlen, pad; char *cp; u_int packet_length = 0; - u_int i, padlen, len; + u_int i, len; u_int32_t rand = 0; Enc *enc = NULL; Mac *mac = NULL; @@ -533,6 +537,15 @@ padlen = block_size - (len % block_size); if (padlen < 4) padlen += block_size; + if (extra_pad) { + /* will wrap if extra_pad+padlen > 255 */ + extra_pad = roundup(extra_pad, block_size); + pad = extra_pad - ((len + padlen) % extra_pad); + debug("packet_send2: adding %d (len %d padlen %d extra_pad %d)", + pad, len, padlen, extra_pad); + padlen += pad; + extra_pad = 0; + } buffer_append_space(&outgoing_packet, &cp, padlen); if (enc && enc->cipher->number != SSH_CIPHER_NONE) { /* random padding */ @@ -1238,6 +1251,13 @@ return s; } +/* roundup current message to pad bytes */ +void +packet_add_padding(u_char pad) +{ + extra_pad = pad; +} + /* * 9.2. Ignored Data Message * @@ -1249,41 +1269,6 @@ * required to send them. This message can be used as an additional * protection measure against advanced traffic analysis techniques. */ -/* size of current + ignore message should be n*sumlen bytes (w/o mac) */ -void -packet_inject_ignore(int sumlen) -{ - int blocksize, padlen, have, need, nb, mini, nbytes; - Enc *enc = NULL; - - if (compat20 == 0) - return; - - have = buffer_len(&outgoing_packet); - debug2("packet_inject_ignore: current %d", have); - if (newkeys[MODE_OUT] != NULL) - enc = &newkeys[MODE_OUT]->enc; - blocksize = enc ? enc->cipher->block_size : 8; - padlen = blocksize - (have % blocksize); - if (padlen < 4) - padlen += blocksize; - have += padlen; - have /= blocksize; /* # of blocks for current message */ - - nb = roundup(sumlen, blocksize) / blocksize; /* blocks for both */ - mini = roundup(5+1+4+4, blocksize) / blocksize; /* minsize ignore msg */ - need = nb - (have % nb); /* blocks for ignore */ - if (need <= mini) - need += nb; - nbytes = (need - mini) * blocksize; /* size of ignore payload */ - debug2("packet_inject_ignore: block %d have %d nb %d mini %d need %d", - blocksize, have, nb, mini, need); - - /* enqueue current message and append a ignore message */ - packet_send(); - packet_send_ignore(nbytes); -} - void packet_send_ignore(int nbytes) { diff -ru openssh-3.0p1/packet.h openssh-3.0.1p1/packet.h --- openssh-3.0p1/packet.h 2001-07-04 14:46:58.000000000 +1000 +++ openssh-3.0.1p1/packet.h 2001-11-12 11:02:52.000000000 +1100 @@ -11,7 +11,7 @@ * called by a name other than "ssh" or "Secure Shell". */ -/* RCSID("$OpenBSD: packet.h,v 1.25 2001/06/26 17:27:24 markus Exp $"); */ +/* RCSID("$OpenBSD: packet.h,v 1.26 2001/11/07 16:03:17 markus Exp $"); */ #ifndef PACKET_H #define PACKET_H @@ -63,7 +63,7 @@ int packet_connection_is_ipv4(void); int packet_remaining(void); void packet_send_ignore(int); -void packet_inject_ignore(int); +void packet_add_padding(u_char); void tty_make_modes(int, struct termios *); void tty_parse_modes(int, int *); diff -ru openssh-3.0p1/readpass.c openssh-3.0.1p1/readpass.c --- openssh-3.0p1/readpass.c 2001-07-19 01:45:45.000000000 +1000 +++ openssh-3.0.1p1/readpass.c 2001-11-12 11:05:21.000000000 +1100 @@ -32,7 +32,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: readpass.c,v 1.22 2001/07/14 15:10:16 stevesk Exp $"); +RCSID("$OpenBSD: readpass.c,v 1.23 2001/11/08 10:51:08 markus Exp $"); #include "xmalloc.h" #include "readpass.h" @@ -45,7 +45,7 @@ { pid_t pid; size_t len; - char *nl, *pass; + char *pass; int p[2], status; char buf[1024]; @@ -71,16 +71,15 @@ fatal("ssh_askpass: exec(%s): %s", askpass, strerror(errno)); } close(p[1]); - len = read(p[0], buf, sizeof buf); + len = read(p[0], buf, sizeof buf -1); close(p[0]); while (waitpid(pid, &status, 0) < 0) if (errno != EINTR) break; if (len <= 1) return xstrdup(""); - nl = strchr(buf, '\n'); - if (nl) - *nl = '\0'; + buf[len] = '\0'; + buf[strcspn(buf, "\r\n")] = '\0'; pass = xstrdup(buf); memset(buf, 0, sizeof(buf)); return pass; diff -ru openssh-3.0p1/servconf.c openssh-3.0.1p1/servconf.c --- openssh-3.0p1/servconf.c 2001-09-13 02:32:15.000000000 +1000 +++ openssh-3.0.1p1/servconf.c 2001-11-14 00:03:15.000000000 +1100 @@ -10,7 +10,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: servconf.c,v 1.89 2001/08/16 19:18:34 jakob Exp $"); +RCSID("$OpenBSD: servconf.c,v 1.91 2001/11/12 18:17:07 markus Exp $"); #if defined(KRB4) || defined(KRB5) #include @@ -43,6 +43,11 @@ initialize_server_options(ServerOptions *options) { memset(options, 0, sizeof(*options)); + + /* Portable-specific options */ + options->pam_authentication_via_kbd_int = -1; + + /* Standard Options */ options->num_ports = 0; options->ports_from_cmdline = 0; options->listen_addrs = NULL; @@ -104,12 +109,16 @@ options->client_alive_count_max = -1; options->authorized_keys_file = NULL; options->authorized_keys_file2 = NULL; - options->pam_authentication_via_kbd_int = -1; } void fill_default_server_options(ServerOptions *options) { + /* Portable-specific options */ + if (options->pam_authentication_via_kbd_int == -1) + options->pam_authentication_via_kbd_int = 0; + + /* Standard Options */ if (options->protocol == SSH_PROTO_UNKNOWN) options->protocol = SSH_PROTO_1|SSH_PROTO_2; if (options->num_host_key_files == 0) { @@ -211,17 +220,23 @@ options->client_alive_interval = 0; if (options->client_alive_count_max == -1) options->client_alive_count_max = 3; + if (options->authorized_keys_file2 == NULL) { + /* authorized_keys_file2 falls back to authorized_keys_file */ + if (options->authorized_keys_file != NULL) + options->authorized_keys_file2 = options->authorized_keys_file; + else + options->authorized_keys_file2 = _PATH_SSH_USER_PERMITTED_KEYS2; + } if (options->authorized_keys_file == NULL) options->authorized_keys_file = _PATH_SSH_USER_PERMITTED_KEYS; - if (options->authorized_keys_file2 == NULL) - options->authorized_keys_file2 = _PATH_SSH_USER_PERMITTED_KEYS2; - if (options->pam_authentication_via_kbd_int == -1) - options->pam_authentication_via_kbd_int = 0; } /* Keyword tokens. */ typedef enum { sBadOption, /* == unknown option */ + /* Portable-specific options */ + sPAMAuthenticationViaKbdInt, + /* Standard Options */ sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime, sKeyRegenerationTime, sPermitRootLogin, sLogFacility, sLogLevel, sRhostsAuthentication, sRhostsRSAAuthentication, sRSAAuthentication, @@ -246,7 +261,7 @@ sBanner, sReverseMappingCheck, sHostbasedAuthentication, sHostbasedUsesNameFromPacketOnly, sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2, - sDeprecated, sPAMAuthenticationViaKbdInt + sDeprecated } ServerOpCodes; /* Textual representation of the tokens. */ @@ -254,6 +269,9 @@ const char *name; ServerOpCodes opcode; } keywords[] = { + /* Portable-specific options */ + { "PAMAuthenticationViaKbdInt", sPAMAuthenticationViaKbdInt }, + /* Standard Options */ { "port", sPort }, { "hostkey", sHostKeyFile }, { "hostdsakey", sHostKeyFile }, /* alias */ @@ -316,7 +334,6 @@ { "clientalivecountmax", sClientAliveCountMax }, { "authorizedkeysfile", sAuthorizedKeysFile }, { "authorizedkeysfile2", sAuthorizedKeysFile2 }, - { "PAMAuthenticationViaKbdInt", sPAMAuthenticationViaKbdInt }, { NULL, 0 } }; @@ -410,6 +427,13 @@ case sBadOption: bad_options++; continue; + + /* Portable-specific options */ + case sPAMAuthenticationViaKbdInt: + intptr = &options->pam_authentication_via_kbd_int; + goto parse_flag; + + /* Standard Options */ case sPort: /* ignore ports from configfile if cmdline specifies ports */ if (options->ports_from_cmdline) @@ -842,10 +866,6 @@ arg = strdelim(&cp); break; - case sPAMAuthenticationViaKbdInt: - intptr = &options->pam_authentication_via_kbd_int; - goto parse_flag; - default: fatal("%s line %d: Missing handler for opcode %s (%d)", filename, linenum, arg, opcode); diff -ru openssh-3.0p1/serverloop.c openssh-3.0.1p1/serverloop.c --- openssh-3.0p1/serverloop.c 2001-10-12 11:35:06.000000000 +1000 +++ openssh-3.0.1p1/serverloop.c 2001-11-12 11:06:33.000000000 +1100 @@ -35,7 +35,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: serverloop.c,v 1.82 2001/10/10 22:18:47 markus Exp $"); +RCSID("$OpenBSD: serverloop.c,v 1.83 2001/11/09 18:59:23 markus Exp $"); #include "xmalloc.h" #include "packet.h" @@ -272,8 +272,8 @@ ret = select((*maxfdp)+1, *readsetp, *writesetp, NULL, tvp); if (ret == -1) { - memset(*readsetp, 0, *maxfdp); - memset(*writesetp, 0, *maxfdp); + memset(*readsetp, 0, *nallocp); + memset(*writesetp, 0, *nallocp); if (errno != EINTR) error("select: %.100s", strerror(errno)); } else if (ret == 0 && client_alive_scheduled) diff -ru openssh-3.0p1/session.c openssh-3.0.1p1/session.c --- openssh-3.0p1/session.c 2001-10-28 22:34:53.000000000 +1100 +++ openssh-3.0.1p1/session.c 2001-11-13 23:46:19.000000000 +1100 @@ -159,7 +159,6 @@ Session sessions[MAX_SESSIONS]; #ifdef WITH_AIXAUTHENTICATE -/* AIX's lastlogin message, set in auth1.c */ char *aixloginmsg; #endif /* WITH_AIXAUTHENTICATE */ @@ -191,6 +190,14 @@ } #endif #endif +#ifdef WITH_AIXAUTHENTICATE + /* We don't have a pty yet, so just label the line as "ssh" */ + if (loginsuccess(authctxt->user, + get_canonical_hostname(options.reverse_mapping_check), + "ssh", &aixloginmsg) < 0) + aixloginmsg = NULL; +#endif /* WITH_AIXAUTHENTICATE */ + /* setup the channel layer */ if (!no_port_forwarding_flag && options.allow_tcp_forwarding) channel_permit_all_opens(); diff -ru openssh-3.0p1/ssh-dss.c openssh-3.0.1p1/ssh-dss.c --- openssh-3.0p1/ssh-dss.c 2001-09-18 15:41:20.000000000 +1000 +++ openssh-3.0.1p1/ssh-dss.c 2001-11-12 11:03:35.000000000 +1100 @@ -23,7 +23,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: ssh-dss.c,v 1.8 2001/09/17 19:27:15 stevesk Exp $"); +RCSID("$OpenBSD: ssh-dss.c,v 1.9 2001/11/07 22:10:28 markus Exp $"); #include #include @@ -138,17 +138,19 @@ if (strcmp("ssh-dss", ktype) != 0) { error("ssh_dss_verify: cannot handle type %s", ktype); buffer_free(&b); + xfree(ktype); return -1; } + xfree(ktype); sigblob = buffer_get_string(&b, &len); rlen = buffer_len(&b); + buffer_free(&b); if(rlen != 0) { - error("remaining bytes in signature %d", rlen); - buffer_free(&b); + error("ssh_dss_verify: " + "remaining bytes in signature %d", rlen); + xfree(sigblob); return -1; } - buffer_free(&b); - xfree(ktype); } if (len != SIGBLOB_LEN) { diff -ru openssh-3.0p1/ssh-keygen.0 openssh-3.0.1p1/ssh-keygen.0 --- openssh-3.0p1/ssh-keygen.0 2001-11-04 11:25:24.000000000 +1100 +++ openssh-3.0.1p1/ssh-keygen.0 2001-11-15 23:27:17.000000000 +1100 @@ -59,9 +59,9 @@ slower. The default is 1024 bits. -c Requests changing the comment in the private and public key - files. The program will prompt for the file containing the priM-- - vate keys, for the passphrase if the key has one, and for the new - comment. + files. This operation is only supported for RSA1 keys. The proM-- + gram will prompt for the file containing the private keys, for + the passphrase if the key has one, and for the new comment. -e This option will read a private or public OpenSSH key file and print the key in a `SECSH Public Key File Format' to stdout. @@ -77,7 +77,9 @@ Public Key File Format'. This option allows importing keys from several commercial SSH implementations. - -l Show fingerprint of specified private or public key file. + -l Show fingerprint of specified public key file. Private RSA1 keys + are also supported. For RSA and DSA keys ssh-keygen tries to + find the matching public key file and prints its fingerprint. -p Requests changing the passphrase of a private key file instead of creating a new private key. The program will prompt for the file diff -ru openssh-3.0p1/ssh-keygen.1 openssh-3.0.1p1/ssh-keygen.1 --- openssh-3.0p1/ssh-keygen.1 2001-09-13 04:35:31.000000000 +1000 +++ openssh-3.0.1p1/ssh-keygen.1 2001-11-12 10:52:44.000000000 +1100 @@ -1,4 +1,4 @@ -.\" $OpenBSD: ssh-keygen.1,v 1.49 2001/09/05 06:23:07 deraadt Exp $ +.\" $OpenBSD: ssh-keygen.1,v 1.50 2001/10/25 21:14:32 markus Exp $ .\" .\" -*- nroff -*- .\" @@ -147,6 +147,7 @@ The default is 1024 bits. .It Fl c Requests changing the comment in the private and public key files. +This operation is only supported for RSA1 keys. The program will prompt for the file containing the private keys, for the passphrase if the key has one, and for the new comment. .It Fl e @@ -168,7 +169,11 @@ This option allows importing keys from several commercial SSH implementations. .It Fl l -Show fingerprint of specified private or public key file. +Show fingerprint of specified public key file. +Private RSA1 keys are also supported. +For RSA and DSA keys +.Nm +tries to find the matching public key file and prints its fingerprint. .It Fl p Requests changing the passphrase of a private key file instead of creating a new private key. diff -ru openssh-3.0p1/ssh-keygen.c openssh-3.0.1p1/ssh-keygen.c --- openssh-3.0p1/ssh-keygen.c 2001-10-04 03:18:38.000000000 +1000 +++ openssh-3.0.1p1/ssh-keygen.c 2001-11-12 10:52:44.000000000 +1100 @@ -12,7 +12,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: ssh-keygen.c,v 1.82 2001/09/28 12:07:09 djm Exp $"); +RCSID("$OpenBSD: ssh-keygen.c,v 1.83 2001/10/25 21:14:32 markus Exp $"); #include #include @@ -615,7 +615,7 @@ fclose(f); } if (invalid) { - printf("%s is not a valid key file.\n", identity_file); + printf("%s is not a public key file.\n", identity_file); exit(1); } exit(0); diff -ru openssh-3.0p1/ssh-keyscan.c openssh-3.0.1p1/ssh-keyscan.c --- openssh-3.0p1/ssh-keyscan.c 2001-10-11 06:45:44.000000000 +1000 +++ openssh-3.0.1p1/ssh-keyscan.c 2001-11-15 08:40:45.000000000 +1100 @@ -36,7 +36,11 @@ /* Flag indicating whether IPv4 or IPv6. This can be set on the command line. Default value is AF_UNSPEC means both IPv4 and IPv6. */ +#ifdef IPV4_DEFAULT +int IPv4or6 = AF_INET; +#else int IPv4or6 = AF_UNSPEC; +#endif int ssh_port = SSH_DEFAULT_PORT; diff -ru openssh-3.0p1/ssh-rsa.c openssh-3.0.1p1/ssh-rsa.c --- openssh-3.0p1/ssh-rsa.c 2001-09-18 15:41:20.000000000 +1000 +++ openssh-3.0.1p1/ssh-rsa.c 2001-11-12 11:07:36.000000000 +1100 @@ -23,7 +23,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: ssh-rsa.c,v 1.10 2001/09/17 19:27:15 stevesk Exp $"); +RCSID("$OpenBSD: ssh-rsa.c,v 1.13 2001/11/10 13:22:42 markus Exp $"); #include #include @@ -54,6 +54,10 @@ error("ssh_rsa_sign: no RSA key"); return -1; } + if (datafellows & SSH_BUG_SIGBLOB) { + error("ssh_rsa_sign: SSH_BUG_SIGBLOB not supported"); + return -1; + } nid = (datafellows & SSH_BUG_RSASIGMD5) ? NID_md5 : NID_sha1; if ((evp_md = EVP_get_digestbynid(nid)) == NULL) { error("ssh_rsa_sign: EVP_get_digestbynid %d failed", nid); @@ -124,6 +128,10 @@ error("ssh_rsa_verify: no RSA key"); return -1; } + if (datafellows & SSH_BUG_SIGBLOB) { + error("ssh_rsa_verify: SSH_BUG_SIGBLOB not supported"); + return -1; + } if (BN_num_bits(key->rsa->n) < 768) { error("ssh_rsa_verify: n too small: %d bits", BN_num_bits(key->rsa->n)); @@ -143,14 +151,14 @@ rlen = buffer_len(&b); buffer_free(&b); if(rlen != 0) { - xfree(sigblob); error("ssh_rsa_verify: remaining bytes in signature %d", rlen); + xfree(sigblob); return -1; } nid = (datafellows & SSH_BUG_RSASIGMD5) ? NID_md5 : NID_sha1; if ((evp_md = EVP_get_digestbynid(nid)) == NULL) { - xfree(sigblob); error("ssh_rsa_verify: EVP_get_digestbynid %d failed", nid); + xfree(sigblob); return -1; } dlen = evp_md->md_size; diff -ru openssh-3.0p1/ssh.0 openssh-3.0.1p1/ssh.0 --- openssh-3.0p1/ssh.0 2001-11-04 11:25:25.000000000 +1100 +++ openssh-3.0.1p1/ssh.0 2001-11-15 23:27:18.000000000 +1100 @@ -149,7 +149,7 @@ ~# List forwarded connections ~& Background ssh at logout when waiting for forwarded connection / - X11 sessions to terminate (protocol version 1 only) + X11 sessions to terminate ~? Display a list of escape characters @@ -875,6 +875,12 @@ file, and for those users who do not have a configuration file. This file must be world-readable. + /etc/ssh_host_key, /etc/ssh_host_dsa_key, /etc/ssh_host_rsa_key + These three files contain the private parts of the host keys and + are used for RhostsRSAAuthentication and HostbasedAuthentication. + Since they are readable only by root ssh must be setuid root if + these authentication methods are desired. + $HOME/.rhosts This file is used in .rhosts authentication to list the host/user pairs that are permitted to log in. (Note that this file is also diff -ru openssh-3.0p1/ssh.1 openssh-3.0.1p1/ssh.1 --- openssh-3.0p1/ssh.1 2001-10-04 03:39:39.000000000 +1000 +++ openssh-3.0.1p1/ssh.1 2001-11-12 11:05:49.000000000 +1100 @@ -34,7 +34,7 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.\" $OpenBSD: ssh.1,v 1.139 2001/10/01 21:51:16 markus Exp $ +.\" $OpenBSD: ssh.1,v 1.141 2001/11/08 17:49:53 markus Exp $ .Dd September 25, 1999 .Dt SSH 1 .Os @@ -294,7 +294,7 @@ List forwarded connections .It Cm ~& Background ssh at logout when waiting for forwarded connection / X11 sessions -to terminate (protocol version 1 only) +to terminate .It Cm ~? Display a list of escape characters .It Cm ~R @@ -1389,6 +1389,15 @@ values that are not specified in the user's configuration file, and for those users who do not have a configuration file. This file must be world-readable. +.It Pa /etc/ssh_host_key, /etc/ssh_host_dsa_key, /etc/ssh_host_rsa_key +These three files contain the private parts of the host keys +and are used for +.Cm RhostsRSAAuthentication +and +.Cm HostbasedAuthentication . +Since they are readable only by root +.Nm +must be setuid root if these authentication methods are desired. .It Pa $HOME/.rhosts This file is used in .Pa \&.rhosts diff -ru openssh-3.0p1/ssh.c openssh-3.0.1p1/ssh.c --- openssh-3.0p1/ssh.c 2001-10-10 15:07:45.000000000 +1000 +++ openssh-3.0.1p1/ssh.c 2001-11-12 10:52:04.000000000 +1100 @@ -39,7 +39,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: ssh.c,v 1.147 2001/10/08 19:05:05 markus Exp $"); +RCSID("$OpenBSD: ssh.c,v 1.149 2001/10/24 08:51:35 markus Exp $"); #include #include @@ -131,14 +131,6 @@ /* socket address the host resolves to */ struct sockaddr_storage hostaddr; -/* - * Flag to indicate that we have received a window change signal which has - * not yet been processed. This will cause a message indicating the new - * window size to be sent to the server a little later. This is volatile - * because this is updated in a signal handler. - */ -volatile int received_window_change_signal = 0; - /* Private host keys. */ struct { Key **keys; @@ -760,6 +752,8 @@ options.user_hostfile2 = tilde_expand_filename(options.user_hostfile2, original_real_uid); + signal(SIGPIPE, SIG_IGN); /* ignore SIGPIPE early */ + /* Log into the remote system. This never returns if the login fails. */ ssh_login(sensitive_data.keys, sensitive_data.nkeys, host, (struct sockaddr *)&hostaddr, pw); diff -ru openssh-3.0p1/sshconnect2.c openssh-3.0.1p1/sshconnect2.c --- openssh-3.0p1/sshconnect2.c 2001-10-10 15:03:12.000000000 +1000 +++ openssh-3.0.1p1/sshconnect2.c 2001-11-12 11:02:52.000000000 +1100 @@ -23,7 +23,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: sshconnect2.c,v 1.83 2001/10/06 11:18:19 markus Exp $"); +RCSID("$OpenBSD: sshconnect2.c,v 1.85 2001/11/07 16:03:17 markus Exp $"); #include #include @@ -460,7 +460,7 @@ packet_put_cstring(password); memset(password, 0, strlen(password)); xfree(password); - packet_inject_ignore(64); + packet_add_padding(64); packet_send(); return 1; } @@ -817,7 +817,7 @@ } packet_done(); /* done with parsing incoming message. */ - packet_inject_ignore(64); + packet_add_padding(64); packet_send(); } @@ -836,16 +836,6 @@ u_int blen, slen; int ok, i, len, found = 0; - p = get_local_name(packet_get_connection_in()); - if (p == NULL) { - error("userauth_hostbased: cannot get local ipaddr/name"); - return 0; - } - len = strlen(p) + 2; - chost = xmalloc(len); - strlcpy(chost, p, len); - strlcat(chost, ".", len); - debug2("userauth_hostbased: chost %s", chost); /* check for a useful key */ for (i = 0; i < authctxt->nkeys; i++) { private = authctxt->keys[i]; @@ -857,14 +847,26 @@ } } if (!found) { - xfree(chost); + debug("userauth_hostbased: no more client hostkeys"); return 0; } if (key_to_blob(private, &blob, &blen) == 0) { key_free(private); - xfree(chost); return 0; } + /* figure out a name for the client host */ + p = get_local_name(packet_get_connection_in()); + if (p == NULL) { + error("userauth_hostbased: cannot get local ipaddr/name"); + key_free(private); + return 0; + } + len = strlen(p) + 2; + chost = xmalloc(len); + strlcpy(chost, p, len); + strlcat(chost, ".", len); + debug2("userauth_hostbased: chost %s", chost); + service = datafellows & SSH_BUG_HBSERVICE ? "ssh-userauth" : authctxt->service; pkalg = xstrdup(key_ssh_name(private)); @@ -882,7 +884,6 @@ #ifdef DEBUG_PK buffer_dump(&b); #endif - debug2("xxx: chost %s", chost); ok = key_sign(private, &signature, &slen, buffer_ptr(&b), buffer_len(&b)); key_free(private); buffer_free(&b); diff -ru openssh-3.0p1/sshd.0 openssh-3.0.1p1/sshd.0 --- openssh-3.0p1/sshd.0 2001-11-04 11:25:25.000000000 +1100 +++ openssh-3.0.1p1/sshd.0 2001-11-15 23:27:19.000000000 +1100 @@ -252,9 +252,9 @@ this threshold is reached while client alive messages are being sent, sshd will disconnect the client, terminating the session. It is important to note that the use of client alive messages is - very different from Keepalive (below). The client alive messages + very different from KeepAlive (below). The client alive messages are sent through the encrypted channel and therefore will not be - spoofable. The TCP keepalive option enabled by Keepalive is + spoofable. The TCP keepalive option enabled by KeepAlive is spoofable. The client alive mechanism is valuable when the client or server depend on knowing when a connection has become inacM-- tive. diff -ru openssh-3.0p1/sshd.8 openssh-3.0.1p1/sshd.8 --- openssh-3.0p1/sshd.8 2001-10-04 03:15:32.000000000 +1000 +++ openssh-3.0.1p1/sshd.8 2001-11-12 11:04:06.000000000 +1100 @@ -34,7 +34,7 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.\" $OpenBSD: sshd.8,v 1.153 2001/09/27 17:53:24 camield Exp $ +.\" $OpenBSD: sshd.8,v 1.154 2001/11/07 22:12:01 markus Exp $ .Dd September 25, 1999 .Dt SSHD 8 .Os @@ -402,11 +402,11 @@ .Nm will disconnect the client, terminating the session. It is important to note that the use of client alive messages is very different from -.Cm Keepalive +.Cm KeepAlive (below). The client alive messages are sent through the encrypted channel and therefore will not be spoofable. The TCP keepalive option enabled by -.Cm Keepalive +.Cm KeepAlive is spoofable. The client alive mechanism is valuable when the client or server depend on knowing when a connection has become inactive. .Pp diff -ru openssh-3.0p1/sshd.c openssh-3.0.1p1/sshd.c --- openssh-3.0p1/sshd.c 2001-10-04 03:46:40.000000000 +1000 +++ openssh-3.0.1p1/sshd.c 2001-11-12 11:07:12.000000000 +1100 @@ -40,7 +40,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: sshd.c,v 1.206 2001/10/02 22:56:09 stevesk Exp $"); +RCSID("$OpenBSD: sshd.c,v 1.209 2001/11/10 13:19:45 markus Exp $"); #include #include @@ -337,7 +337,7 @@ /* Send our protocol version identification. */ if (atomicio(write, sock_out, server_version_string, strlen(server_version_string)) != strlen(server_version_string)) { - log("Could not write ident string to %s.", get_remote_ipaddr()); + log("Could not write ident string to %s", get_remote_ipaddr()); fatal_cleanup(); } @@ -345,7 +345,7 @@ memset(buf, 0, sizeof(buf)); for (i = 0; i < sizeof(buf) - 1; i++) { if (atomicio(read, sock_in, &buf[i], 1) != 1) { - log("Did not receive identification string from %s.", + log("Did not receive identification string from %s", get_remote_ipaddr()); fatal_cleanup(); } @@ -1134,9 +1134,8 @@ remote_port = get_remote_port(); remote_ip = get_remote_ipaddr(); - /* Check whether logins are denied from this host. */ #ifdef LIBWRAP - /* XXX LIBWRAP noes not know about IPv6 */ + /* Check whether logins are denied from this host. */ { struct request_info req; @@ -1144,13 +1143,14 @@ fromhost(&req); if (!hosts_access(&req)) { + debug("Connection refused by tcp wrapper"); refuse(&req); - close(sock_in); - close(sock_out); + /* NOTREACHED */ + fatal("libwrap refuse returns"); } -/*XXX IPv6 verbose("Connection from %.500s port %d", eval_client(&req), remote_port); */ } #endif /* LIBWRAP */ + /* Log the connection. */ verbose("Connection from %.500s port %d", remote_ip, remote_port); @@ -1177,7 +1177,7 @@ if (remote_port >= IPPORT_RESERVED || remote_port < IPPORT_RESERVED / 2) { debug("Rhosts Authentication disabled, " - "originating port not trusted."); + "originating port %d not trusted.", remote_port); options.rhosts_authentication = 0; } #if defined(KRB4) && !defined(KRB5) diff -ru openssh-3.0p1/version.h openssh-3.0.1p1/version.h --- openssh-3.0p1/version.h 2001-10-25 01:20:57.000000000 +1000 +++ openssh-3.0.1p1/version.h 2001-11-14 00:05:30.000000000 +1100 @@ -1,3 +1,3 @@ /* $OpenBSD: version.h,v 1.25 2001/10/15 16:10:50 deraadt Exp $ */ -#define SSH_VERSION "OpenSSH_3.0p1" +#define SSH_VERSION "OpenSSH_3.0.1p1"