Attachment 1518 Details for Bug 983 – Updates RequireBothPasswordAndPubKey patch to current cvs snapshot

[patch] Updates RequireBothPasswordAndPubKey patch to current cvs snapshot

openssh-req-pubkey-pwd.patch (text/plain), 8.38 KB, created by Paul Sery on 2008-06-13 16:26:33 AEST

(hide)

Description:

Filename:

MIME Type:

Creator: Paul Sery

Created: 2008-06-13 16:26:33 AEST

Size: 8.38 KB

patch

obsolete

>--- openssh/auth2-passwd.c	2006-08-04 20:39:39.000000000 -0600
>+++ openssh-req-pubkey-pwd/auth2-passwd.c	2008-06-12 22:48:45.000000000 -0600
>@@ -74,6 +74,7 @@
> #endif
> 	memset(password, 0, len);
> 	xfree(password);
>+	auth2_multiple_auth("password", authctxt, &authenticated);
> 	return authenticated;
> }
> 
>--- openssh/auth2-pubkey.c	2008-06-12 22:51:28.000000000 -0600
>+++ openssh-req-pubkey-pwd/auth2-pubkey.c	2008-06-12 22:48:45.000000000 -0600
>@@ -1,4 +1,4 @@
>-/* $OpenBSD: auth2-pubkey.c,v 1.16 2008/06/13 04:40:22 djm Exp $ */
>+/* $OpenBSD: auth2-pubkey.c,v 1.15 2006/08/03 03:34:41 deraadt Exp $ */
> /*
>  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
>  *
>@@ -28,7 +28,6 @@
> #include <sys/types.h>
> #include <sys/stat.h>
> 
>-#include <fcntl.h>
> #include <pwd.h>
> #include <stdio.h>
> #include <stdarg.h>
>@@ -140,6 +139,7 @@
> 			authenticated = 1;
> 		buffer_free(&b);
> 		xfree(sig);
>+		auth2_multiple_auth("publickey", authctxt, &authenticated);
> 	} else {
> 		debug("test whether pkalg/pkblob are acceptable");
> 		packet_check_eom();
>@@ -181,7 +181,7 @@
> user_key_allowed2(struct passwd *pw, Key *key, char *file)
> {
> 	char line[SSH_MAX_PUBKEY_BYTES];
>-	int found_key = 0, fd;
>+	int found_key = 0;
> 	FILE *f;
> 	u_long linenum = 0;
> 	struct stat st;
>@@ -193,29 +193,16 @@
> 
> 	debug("trying public key file %s", file);
> 
>-	/*
>-	 * Open the file containing the authorized keys
>-	 * Fail quietly if file does not exist
>-	 */
>-	if ((fd = open(file, O_RDONLY|O_NONBLOCK)) == -1) {
>+	/* Fail quietly if file does not exist */
>+	if (stat(file, &st) < 0) {
>+		/* Restore the privileged uid. */
> 		restore_uid();
> 		return 0;
> 	}
>-	if (fstat(fd, &st) < 0) {
>-		close(fd);
>-		restore_uid();
>-		return 0;
>-	}
>-	if (!S_ISREG(st.st_mode)) {
>-		logit("User %s authorized keys %s is not a regular file",
>-		    pw->pw_name, file);
>-		close(fd);
>-		restore_uid();
>-		return 0;
>-	}
>-	unset_nonblock(fd);
>-	if ((f = fdopen(fd, "r")) == NULL) {
>-		close(fd);
>+	/* Open the file containing the authorized keys. */
>+	f = fopen(file, "r");
>+	if (!f) {
>+		/* Restore the privileged uid. */
> 		restore_uid();
> 		return 0;
> 	}
>--- openssh/auth2.c	2007-10-25 22:26:16.000000000 -0600
>+++ openssh-req-pubkey-pwd/auth2.c	2008-06-12 22:48:45.000000000 -0600
>@@ -251,8 +251,12 @@
> 	/* Log before sending the reply */
> 	auth_log(authctxt, authenticated, method, " ssh2");
> 
>-	if (authctxt->postponed)
>+	if (authctxt->postponed) {
>+		if (!authctxt->multiple_auth_failure &&
>+			authctxt->multiple_auth.flags)
>+			goto fake_auth_failure;
> 		return;
>+	}
> 
> 	/* XXX todo: check if multiple auth methods are needed */
> 	if (authenticated == 1) {
>@@ -270,6 +274,7 @@
> #endif
> 			packet_disconnect(AUTH_FAIL_MSG, authctxt->user);
> 		}
>+fake_auth_failure:
> 		methods = authmethods_get();
> 		packet_start(SSH2_MSG_USERAUTH_FAILURE);
> 		packet_put_cstring(methods);
>@@ -280,6 +285,44 @@
> 	}
> }
> 
>+void
>+auth2_multiple_auth(const char *method, Authctxt *authctxt, int *authenticated)
>+{
>+	debug3("%s[%d],entry,method %s,auth(%d,%d,%d),*auth %d,postponed %d",
>+		__func__, getpid(), method, authctxt->multiple_auth_failure,
>+		authctxt->multiple_auth.pubkey_passwd.passwd,
>+		authctxt->multiple_auth.pubkey_passwd.pubkey, *authenticated,
>+		authctxt->postponed);
>+
>+	if (options.require_both_password_and_pub_key == 1 &&
>+		(!strcasecmp(method, "password") ||
>+		!strcasecmp(method, "publickey"))) {
>+		if (!*authenticated && !strcasecmp(method, "publickey"))
>+			authctxt->multiple_auth_failure = 1;
>+		else if (!authctxt->multiple_auth_failure) {
>+			if (!strcasecmp(method, "password"))
>+				authctxt->
>+					multiple_auth.pubkey_passwd.passwd = 1;
>+			else if (!strcasecmp(method, "publickey"))
>+				authctxt->
>+					multiple_auth.pubkey_passwd.pubkey = 1;
>+
>+			if (!authctxt->multiple_auth.pubkey_passwd.passwd ||
>+				!authctxt->multiple_auth.pubkey_passwd.pubkey) {
>+				authctxt->postponed = 1;
>+				*authenticated = 0;
>+			}
>+		}
>+		else
>+			*authenticated = 0;
>+	}
>+	debug3("%s[%d],exit,multiple_auth (%d,%d,%d),*auth %d,postponed %d",
>+		__func__, getpid(), authctxt->multiple_auth_failure,
>+		authctxt->multiple_auth.pubkey_passwd.passwd,
>+		authctxt->multiple_auth.pubkey_passwd.pubkey, *authenticated,
>+		authctxt->postponed);
>+}
>+
> static char *
> authmethods_get(void)
> {
>--- openssh/monitor.c	2008-05-18 23:34:50.000000000 -0600
>+++ openssh-req-pubkey-pwd/monitor.c	2008-06-12 22:48:45.000000000 -0600
>@@ -379,6 +379,9 @@
> 			if (!authenticated)
> 				authctxt->failures++;
> 		}
>+		if ((ent->type == MONITOR_REQ_KEYVERIFY ||
>+			ent->type == MONITOR_REQ_AUTHPASSWORD))
>+			auth2_multiple_auth(auth_method, authctxt, &authenticated);
> 	}
> 
> 	if (!authctxt->valid)
>--- openssh/servconf.c	2008-06-10 17:34:46.000000000 -0600
>+++ openssh-req-pubkey-pwd/servconf.c	2008-06-12 22:50:16.000000000 -0600
>@@ -123,6 +123,7 @@
> 	options->authorized_keys_file = NULL;
> 	options->authorized_keys_file2 = NULL;
> 	options->num_accept_env = 0;
>+	options->require_both_password_and_pub_key = -1;
> 	options->permit_tun = -1;
> 	options->num_permitted_opens = -1;
> 	options->adm_forced_command = NULL;
>@@ -256,6 +257,11 @@
> 	}
> 	if (options->authorized_keys_file == NULL)
> 		options->authorized_keys_file = _PATH_SSH_USER_PERMITTED_KEYS;
>+	if (options->require_both_password_and_pub_key == -1)
>+		options->require_both_password_and_pub_key = 0;
>+	else if (options->require_both_password_and_pub_key == 1)
>+		options->password_authentication =
>+			options->pubkey_authentication = 1;
> 	if (options->permit_tun == -1)
> 		options->permit_tun = SSH_TUNMODE_NO;
> 
>@@ -302,6 +308,7 @@
> 	sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel,
> 	sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
> 	sUsePrivilegeSeparation, sAllowAgentForwarding,
>+	sRequireBothPasswordAndPubKey,
> 	sDeprecated, sUnsupported
> } ServerOpCodes;
> 
>@@ -410,6 +417,7 @@
> 	{ "authorizedkeysfile2", sAuthorizedKeysFile2, SSHCFG_GLOBAL },
> 	{ "useprivilegeseparation", sUsePrivilegeSeparation, SSHCFG_GLOBAL },
> 	{ "acceptenv", sAcceptEnv, SSHCFG_GLOBAL },
>+	{ "requirebothpasswordandpubkey", sRequireBothPasswordAndPubKey },
> 	{ "permittunnel", sPermitTunnel, SSHCFG_GLOBAL },
>  	{ "match", sMatch, SSHCFG_ALL },
> 	{ "permitopen", sPermitOpen, SSHCFG_ALL },
>@@ -979,6 +987,10 @@
> 			*intptr = value;
> 		break;
> 
>+	case sRequireBothPasswordAndPubKey:
>+		intptr = &options->require_both_password_and_pub_key;
>+		goto parse_flag;
>+
> 	case sGatewayPorts:
> 		intptr = &options->gateway_ports;
> 		arg = strdelim(&cp);
>--- openssh/servconf.h	2008-06-10 07:01:51.000000000 -0600
>+++ openssh-req-pubkey-pwd/servconf.h	2008-06-12 22:48:45.000000000 -0600
>@@ -96,6 +96,7 @@
> 						 * authentication. */
> 	int     kbd_interactive_authentication;	/* If true, permit */
> 	int     challenge_response_authentication;
>+	int	require_both_password_and_pub_key;
> 	int     permit_empty_passwd;	/* If false, do not permit empty
> 					 * passwords. */
> 	int     permit_user_env;	/* If true, read ~/.ssh/environment */
>--- openssh/auth.h	2007-10-25 22:25:13.000000000 -0600
>+++ openssh-req-pubkey-pwd/auth.h	2008-06-12 22:48:45.000000000 -0600
>@@ -71,6 +71,14 @@
> #endif
> 	Buffer		*loginmsg;
> 	void		*methoddata;
>+	union {
>+		struct {
>+			unsigned passwd : 1;
>+			unsigned pubkey : 1;
>+		} pubkey_passwd;
>+		unsigned flags;
>+	} multiple_auth;
>+	unsigned multiple_auth_failure : 1; 
> };
> /*
>  * Every authentication method has to handle authentication requests for
>@@ -151,6 +159,7 @@
> 
> int	auth2_challenge(Authctxt *, char *);
> void	auth2_challenge_stop(Authctxt *);
>+void	auth2_multiple_auth(const char *, Authctxt *, int *);
> int	bsdauth_query(void *, char **, char **, u_int *, char ***, u_int **);
> int	bsdauth_respond(void *, u_int, char **);
> int	skey_query(void *, char **, char **, u_int *, char ***, u_int **);
>--- openssh/sshd_config.5	2008-06-10 07:05:21.000000000 -0600
>+++ openssh-req-pubkey-pwd/sshd_config.5	2008-06-12 22:48:45.000000000 -0600
>@@ -796,6 +796,20 @@
> The default is
> .Dq yes .
> Note that this option applies to protocol version 2 only.
>+.It Cm RequireBothPasswordAndPubKey
>+Specifies whether both password and public key authentication must
>+be successful before authentication is allowed.  If 
>+.Dq yes ,
>+then this option performs both types of authentication, overriding any
>+values for the
>+.Cm PubkeyAuthentication
>+and
>+.Cm PasswordAuthentication
>+options, setting both implicitly to 
>+.Dq yes .
>+The default is
>+.Dq no .
>+This option applies to protocol version 2 only.
> .It Cm RhostsRSAAuthentication
> Specifies whether rhosts or /etc/hosts.equiv authentication together
> with successful RSA host authentication is allowed.

Actions: View | Diff

Attachments on bug 983: 807 | 941 | 1121 | 1122 | 1123 | 1455 | 1518 | 1521 | 1567 | 1667 | 1768 | 1955 | 1999 | 2079 | 2084 | 2096 | 2138 | 2177 | 2178 | 2192 | 2196