Attachment 623 Details for Bug 561 – Add MaxAuthTries and MaxAuthTriesLog, patch against OpenBSD

[patch] Add MaxAuthTries and MaxAuthTriesLog, patch against OpenBSD

openbsd-maxauthtries.patch (text/plain), 5.96 KB, created by Darren Tucker on 2004-05-03 11:46:21 AEST

(hide)

Description:

Filename:

MIME Type:

Creator: Darren Tucker

Created: 2004-05-03 11:46:21 AEST

Size: 5.96 KB

patch

obsolete

>Index: auth.c
>===================================================================
>RCS file: /cvs/src/usr.bin/ssh/auth.c,v
>retrieving revision 1.51
>diff -u -p -r1.51 auth.c
>--- auth.c	21 Nov 2003 11:57:02 -0000	1.51
>+++ auth.c	3 May 2004 01:40:53 -0000
>@@ -162,7 +162,7 @@ auth_log(Authctxt *authctxt, int authent
> 	/* Raise logging level */
> 	if (authenticated == 1 ||
> 	    !authctxt->valid ||
>-	    authctxt->failures >= AUTH_FAIL_LOG ||
>+	    authctxt->failures >= options.max_authtries_log ||
> 	    strcmp(method, "password") == 0)
> 		authlog = logit;
> 
>Index: auth.h
>===================================================================
>RCS file: /cvs/src/usr.bin/ssh/auth.h,v
>retrieving revision 1.49
>diff -u -p -r1.49 auth.h
>--- auth.h	30 Jan 2004 09:48:57 -0000	1.49
>+++ auth.h	3 May 2004 01:40:53 -0000
>@@ -170,8 +170,6 @@ void	 auth_debug_reset(void);
> 
> struct passwd *fakepw(void);
> 
>-#define AUTH_FAIL_MAX 6
>-#define AUTH_FAIL_LOG (AUTH_FAIL_MAX/2)
> #define AUTH_FAIL_MSG "Too many authentication failures for %.100s"
> 
> #define SKEY_PROMPT "\nS/Key Password: "
>Index: auth1.c
>===================================================================
>RCS file: /cvs/src/usr.bin/ssh/auth1.c,v
>retrieving revision 1.55
>diff -u -p -r1.55 auth1.c
>--- auth1.c	8 Nov 2003 16:02:40 -0000	1.55
>+++ auth1.c	3 May 2004 01:40:53 -0000
>@@ -221,7 +221,7 @@ do_authloop(Authctxt *authctxt)
> 		if (authenticated)
> 			return;
> 
>-		if (authctxt->failures++ > AUTH_FAIL_MAX)
>+		if (authctxt->failures++ > options.max_authtries)
> 			packet_disconnect(AUTH_FAIL_MSG, authctxt->user);
> 
> 		packet_start(SSH_SMSG_FAILURE);
>Index: auth2.c
>===================================================================
>RCS file: /cvs/src/usr.bin/ssh/auth2.c,v
>retrieving revision 1.104
>diff -u -p -r1.104 auth2.c
>--- auth2.c	4 Nov 2003 08:54:09 -0000	1.104
>+++ auth2.c	3 May 2004 01:40:53 -0000
>@@ -223,7 +223,7 @@ userauth_finish(Authctxt *authctxt, int 
> 		/* now we can break out */
> 		authctxt->success = 1;
> 	} else {
>-		if (authctxt->failures++ > AUTH_FAIL_MAX)
>+		if (authctxt->failures++ > options.max_authtries)
> 			packet_disconnect(AUTH_FAIL_MSG, authctxt->user);
> 		methods = authmethods_get();
> 		packet_start(SSH2_MSG_USERAUTH_FAILURE);
>Index: servconf.c
>===================================================================
>RCS file: /cvs/src/usr.bin/ssh/servconf.c,v
>retrieving revision 1.131
>diff -u -p -r1.131 servconf.c
>--- servconf.c	27 Apr 2004 09:46:37 -0000	1.131
>+++ servconf.c	3 May 2004 01:40:54 -0000
>@@ -90,6 +90,8 @@ initialize_server_options(ServerOptions 
> 	options->max_startups_begin = -1;
> 	options->max_startups_rate = -1;
> 	options->max_startups = -1;
>+	options->max_authtries = -1;
>+	options->max_authtries_log = -1;
> 	options->banner = NULL;
> 	options->use_dns = -1;
> 	options->client_alive_interval = -1;
>@@ -203,6 +205,10 @@ fill_default_server_options(ServerOption
> 		options->max_startups_rate = 100;		/* 100% */
> 	if (options->max_startups_begin == -1)
> 		options->max_startups_begin = options->max_startups;
>+	if (options->max_authtries == -1)
>+		options->max_authtries = DEFAULT_AUTH_FAIL_MAX;
>+	if (options->max_authtries_log == -1)
>+		options->max_authtries_log = options->max_authtries / 2;
> 	if (options->use_dns == -1)
> 		options->use_dns = 1;
> 	if (options->client_alive_interval == -1)
>@@ -240,7 +246,8 @@ typedef enum {
> 	sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression,
> 	sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
> 	sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
>-	sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem, sMaxStartups,
>+	sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem,
>+	sMaxStartups, sMaxAuthTries, sMaxAuthTriesLog,
> 	sBanner, sUseDNS, sHostbasedAuthentication,
> 	sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
> 	sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2,
>@@ -323,6 +330,8 @@ static struct {
> 	{ "gatewayports", sGatewayPorts },
> 	{ "subsystem", sSubsystem },
> 	{ "maxstartups", sMaxStartups },
>+	{ "maxauthtries", sMaxAuthTries },
>+	{ "maxauthtrieslog", sMaxAuthTriesLog },
> 	{ "banner", sBanner },
> 	{ "usedns", sUseDNS },
> 	{ "verifyreversemapping", sDeprecated },
>@@ -828,6 +837,14 @@ parse_flag:
> 		else
> 			options->max_startups = options->max_startups_begin;
> 		break;
>+
>+	case sMaxAuthTries:
>+		intptr = &options->max_authtries;
>+		goto parse_int;
>+
>+	case sMaxAuthTriesLog:
>+		intptr = &options->max_authtries_log;
>+		goto parse_int;
> 
> 	case sBanner:
> 		charptr = &options->banner;
>Index: servconf.h
>===================================================================
>RCS file: /cvs/src/usr.bin/ssh/servconf.h,v
>retrieving revision 1.68
>diff -u -p -r1.68 servconf.h
>--- servconf.h	27 Apr 2004 09:46:37 -0000	1.68
>+++ servconf.h	3 May 2004 01:40:54 -0000
>@@ -33,6 +33,7 @@
> #define	PERMIT_NO_PASSWD	2
> #define	PERMIT_YES		3
> 
>+#define DEFAULT_AUTH_FAIL_MAX	6	/* Default for MaxAuthTries */
> 
> typedef struct {
> 	u_int num_ports;
>@@ -114,6 +115,8 @@ typedef struct {
> 	int	max_startups_begin;
> 	int	max_startups_rate;
> 	int	max_startups;
>+	int	max_authtries;
>+	int	max_authtries_log;
> 	char   *banner;			/* SSH-2 banner message */
> 	int	use_dns;
> 	int	client_alive_interval;	/*
>Index: sshd_config.5
>===================================================================
>RCS file: /cvs/src/usr.bin/ssh/sshd_config.5,v
>retrieving revision 1.32
>diff -u -p -r1.32 sshd_config.5
>--- sshd_config.5	28 Apr 2004 07:02:56 -0000	1.32
>+++ sshd_config.5	3 May 2004 01:40:54 -0000
>@@ -402,6 +402,13 @@ for data integrity protection.
> Multiple algorithms must be comma-separated.
> The default is
> .Dq hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96 .
>+.It Cm MaxAuthTries
>+Specifies the maximum number of authentication attempts permitted per
>+connection.  The default is 6.
>+.It Cm MaxAuthTriesLog
>+Specifies the number of authentication failures required to generate a
>+failure message in the log.  The default is half of
>+.Cm MaxAuthTries .
> .It Cm MaxStartups
> Specifies the maximum number of concurrent unauthenticated connections to the
> .Nm sshd

Actions: View | Diff

Attachments on bug 561: 382 | 623 | 636