Attachment #1927 for bug #1780




	if (problem)
		goto out;

	if (options.use_kuserok) {
		if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user, client)) {
			problem = -1;
			goto out;
		}
	} else {
		char kuser[65];
		if (krb5_aname_to_localname(authctxt->krb5_ctx, authctxt->krb5_user, sizeof(kuser), kuser)) {
			problem = -1;
			goto out;
		}
		if (strcmp(kuser, client)) {
			problem = -1;
			goto out;
		}
	}

	problem = ssh_krb5_cc_gen(authctxt->krb5_ctx, &authctxt->krb5_fwd_ccache);




		    krb5_get_err_text(krb_context, retval));
		return 0;
	}
	if (options.use_kuserok) {
		if (krb5_kuserok(krb_context, princ, name)) {
			retval = 1;
			logit("Authorized to %s, krb5 principal %s (krb5_kuserok)",
			    name, (char *)client->displayname.value);
		} else
			retval = 0;
	} else {
		char kuser[65];
		if (krb5_aname_to_localname(krb_context, princ, sizeof(kuser), kuser))
			retval = 0;
		else if (strcmp(kuser, client))
			retval = 0;
		else {
			retval = 1;
			logit("Authorized to %s, krb5 principal %s (krb5)",
			    name, (char *)client->displayname.value);
		}
	}
	krb5_free_principal(krb_context, princ);
	return retval;
}

Lines 138-143 initialize_server_options(ServerOptions Link Here

(-)openssh-5.6p1/servconf.c.kuserok (-1 / +12 lines)
138	options->revoked_keys_file = NULL;	138	options->revoked_keys_file = NULL;
139	options->trusted_user_ca_keys = NULL;	139	options->trusted_user_ca_keys = NULL;
140	options->authorized_principals_file = NULL;	140	options->authorized_principals_file = NULL;
		141	options->use_kuserok = -1;
141	}	142	}
142		143
143	void	144	void
Lines 286-291 fill_default_server_options(ServerOption Link Here
286	if (use_privsep == -1)	287	if (use_privsep == -1)
287	use_privsep = 1;	288	use_privsep = 1;
288		289
		290	if (options->use_kuserok == -1)
		291	options->use_kuserok = 1;
289	#ifndef HAVE_MMAP	292	#ifndef HAVE_MMAP
290	if (use_privsep && options->compression == 1) {	293	if (use_privsep && options->compression == 1) {
291	error("This platform does not support both privilege "	294	error("This platform does not support both privilege "
Lines 307-313 typedef enum { Link Here
307	sPermitRootLogin, sLogFacility, sLogLevel,	310	sPermitRootLogin, sLogFacility, sLogLevel,
308	sRhostsRSAAuthentication, sRSAAuthentication,	311	sRhostsRSAAuthentication, sRSAAuthentication,
309	sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,	312	sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
310	sKerberosGetAFSToken,	313	sKerberosGetAFSToken, sKerberosUseKuserok,
311	sKerberosTgtPassing, sChallengeResponseAuthentication,	314	sKerberosTgtPassing, sChallengeResponseAuthentication,
312	sPasswordAuthentication, sKbdInteractiveAuthentication,	315	sPasswordAuthentication, sKbdInteractiveAuthentication,
313	sListenAddress, sAddressFamily,	316	sListenAddress, sAddressFamily,
Lines 377-387 static struct { Link Here
377	#else	380	#else
378	{ "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },	381	{ "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
379	#endif	382	#endif
		383	{ "kerberosusekuserok", sKerberosUseKuserok, SSHCFG_ALL },
380	#else	384	#else
381	{ "kerberosauthentication", sUnsupported, SSHCFG_ALL },	385	{ "kerberosauthentication", sUnsupported, SSHCFG_ALL },
382	{ "kerberosorlocalpasswd", sUnsupported, SSHCFG_GLOBAL },	386	{ "kerberosorlocalpasswd", sUnsupported, SSHCFG_GLOBAL },
383	{ "kerberosticketcleanup", sUnsupported, SSHCFG_GLOBAL },	387	{ "kerberosticketcleanup", sUnsupported, SSHCFG_GLOBAL },
384	{ "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },	388	{ "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
		389	{ "kerberosusekuserok", sUnsupported, SSHCFG_ALL },
385	#endif	390	#endif
386	{ "kerberostgtpassing", sUnsupported, SSHCFG_GLOBAL },	391	{ "kerberostgtpassing", sUnsupported, SSHCFG_GLOBAL },
387	{ "afstokenpassing", sUnsupported, SSHCFG_GLOBAL },	392	{ "afstokenpassing", sUnsupported, SSHCFG_GLOBAL },
Lines 1341-1346 process_server_config_line(ServerOptions Link Here
1341	*activep = value;	1346	*activep = value;
1342	break;	1347	break;
1343		1348
		1349	case sKerberosUseKuserok:
		1350	intptr = &options->use_kuserok;
		1351	goto parse_flag;
		1352
1344	case sPermitOpen:	1353	case sPermitOpen:
1345	arg = strdelim(&cp);	1354	arg = strdelim(&cp);
1346	if (!arg \|\| *arg == '\0')	1355	if (!arg \|\| *arg == '\0')
Lines 1525-1530 copy_set_server_options(ServerOptions *d Link Here
1525	M_CP_INTOPT(x11_use_localhost);	1534	M_CP_INTOPT(x11_use_localhost);
1526	M_CP_INTOPT(max_sessions);	1535	M_CP_INTOPT(max_sessions);
1527	M_CP_INTOPT(max_authtries);	1536	M_CP_INTOPT(max_authtries);
		1537	M_CP_INTOPT(use_kuserok);
1528		1538
1529	M_CP_STROPT(banner);	1539	M_CP_STROPT(banner);
1530	if (preauth)	1540	if (preauth)
Lines 1745-1750 dump_config(ServerOptions *o) Link Here
1745	dump_cfg_fmtint(sUseDNS, o->use_dns);	1755	dump_cfg_fmtint(sUseDNS, o->use_dns);
1746	dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);	1756	dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
1747	dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);	1757	dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
		1758	dump_cfg_fmtint(sKerberosUseKuserok, o->use_kuserok);
1748		1759
1749	/* string arguments */	1760	/* string arguments */
1750	dump_cfg_string(sPidFile, o->pid_file);	1761	dump_cfg_string(sPidFile, o->pid_file);

Lines 157-162 typedef struct { Link Here

(-)openssh-5.6p1/servconf.h.kuserok (+1 lines)
157		157
158	int num_permitted_opens;	158	int num_permitted_opens;
159		159
		160	int use_kuserok;
160	char *chroot_directory;	161	char *chroot_directory;
161	char *revoked_keys_file;	162	char *revoked_keys_file;
162	char *trusted_user_ca_keys;	163	char *trusted_user_ca_keys;

Lines 564-569 Specifies whether to automatically destr Link Here

(-)openssh-5.6p1/sshd_config.5.kuserok (+5 lines)
564	file on logout.	564	file on logout.
565	The default is	565	The default is
566	.Dq yes .	566	.Dq yes .
		567	.It Cm KerberosUseKuserok
		568	Specifies whether to look at .k5login file for user's aliases.
		569	The default is
		570	.Dq yes .
567	.It Cm KeyRegenerationInterval	571	.It Cm KeyRegenerationInterval
568	In protocol version 1, the ephemeral server key is automatically regenerated	572	In protocol version 1, the ephemeral server key is automatically regenerated
569	after this many seconds (if it has been used).	573	after this many seconds (if it has been used).
Lines 694-699 Available keywords are Link Here
694	.Cm HostbasedUsesNameFromPacketOnly ,	698	.Cm HostbasedUsesNameFromPacketOnly ,
695	.Cm KbdInteractiveAuthentication ,	699	.Cm KbdInteractiveAuthentication ,
696	.Cm KerberosAuthentication ,	700	.Cm KerberosAuthentication ,
		701	.Cm KerberosUseKuserok ,
697	.Cm MaxAuthTries ,	702	.Cm MaxAuthTries ,
698	.Cm MaxSessions ,	703	.Cm MaxSessions ,
699	.Cm PubkeyAuthentication ,	704	.Cm PubkeyAuthentication ,

Lines 72-77 ChallengeResponseAuthentication no Link Here

(-)openssh-5.6p1/sshd_config.kuserok (+1 lines)
72	#KerberosOrLocalPasswd yes	72	#KerberosOrLocalPasswd yes
73	#KerberosTicketCleanup yes	73	#KerberosTicketCleanup yes
74	#KerberosGetAFSToken no	74	#KerberosGetAFSToken no
		75	#KerberosUseKuserok yes
75		76
76	# GSSAPI options	77	# GSSAPI options
77	#GSSAPIAuthentication no	78	#GSSAPIAuthentication no

Return to bug 1780

Lines 146-154 auth_krb5_password(Authctxt *authctxt, c Link Here

(-)openssh-5.6p1/auth-krb5.c.kuserok (-3 / +15 lines)
146	if (problem)	146	if (problem)
147	goto out;	147	goto out;
148		148
149	if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user, client)) {	149	if (options.use_kuserok) {
150	problem = -1;	150	if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user, client)) {
151	goto out;	151	problem = -1;
		152	goto out;
		153	}
		154	} else {
		155	char kuser[65];
		156	if (krb5_aname_to_localname(authctxt->krb5_ctx, authctxt->krb5_user, sizeof(kuser), kuser)) {
		157	problem = -1;
		158	goto out;
		159	}
		160	if (strcmp(kuser, client)) {
		161	problem = -1;
		162	goto out;
		163	}
152	}	164	}
153		165
154	problem = ssh_krb5_cc_gen(authctxt->krb5_ctx, &authctxt->krb5_fwd_ccache);	166	problem = ssh_krb5_cc_gen(authctxt->krb5_ctx, &authctxt->krb5_fwd_ccache);

Lines 97-109 ssh_gssapi_krb5_userok(ssh_gssapi_client Link Here

(-)openssh-5.6p1/gss-serv-krb5.c.kuserok (-7 / +19 lines)
97	krb5_get_err_text(krb_context, retval));	97	krb5_get_err_text(krb_context, retval));
98	return 0;	98	return 0;
99	}	99	}
100	if (krb5_kuserok(krb_context, princ, name)) {	100	if (options.use_kuserok) {
101	retval = 1;	101	if (krb5_kuserok(krb_context, princ, name)) {
102	logit("Authorized to %s, krb5 principal %s (krb5_kuserok)",	102	retval = 1;
103	name, (char *)client->displayname.value);	103	logit("Authorized to %s, krb5 principal %s (krb5_kuserok)",
104	} else	104	name, (char *)client->displayname.value);
105	retval = 0;	105	} else
106		106	retval = 0;
		107	} else {
		108	char kuser[65];
		109	if (krb5_aname_to_localname(krb_context, princ, sizeof(kuser), kuser))
		110	retval = 0;
		111	else if (strcmp(kuser, client))
		112	retval = 0;
		113	else {
		114	retval = 1;
		115	logit("Authorized to %s, krb5 principal %s (krb5)",
		116	name, (char *)client->displayname.value);
		117	}
		118	}
107	krb5_free_principal(krb_context, princ);	119	krb5_free_principal(krb_context, princ);
108	return retval;	120	return retval;
109	}	121	}