Attachment 1182 Details for Bug 928 – Add new option to allow better operation on multi-homed hosts

[patch] Add new option to allow better operation on multi-homed hosts

openssh-cvs-gss-strict-accept.patch (text/plain), 5.67 KB, created by Simon Wilkinson on 2006-09-11 00:04:52 AEST

(hide)

Description:

Filename:

MIME Type:

Creator: Simon Wilkinson

Created: 2006-09-11 00:04:52 AEST

Size: 5.67 KB

patch

obsolete

>--- openssh/gss-serv.c.preaccept	2006-09-10 14:00:47.000000000 +0100
>+++ openssh/gss-serv.c	2006-09-10 14:31:35.000000000 +0100
>@@ -43,9 +43,12 @@
> #include "channels.h"
> #include "session.h"
> #include "misc.h"
>+#include "servconf.h"
> 
> #include "ssh-gss.h"
> 
>+extern ServerOptions options;
>+
> static ssh_gssapi_client gssapi_client =
>     { GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER,
>     GSS_C_NO_CREDENTIAL, NULL, {NULL, NULL, NULL}};
>@@ -111,25 +114,32 @@
> 	char lname[MAXHOSTNAMELEN];
> 	gss_OID_set oidset;
> 
>-	gss_create_empty_oid_set(&status, &oidset);
>-	gss_add_oid_set_member(&status, ctx->oid, &oidset);
>+	if (options.gss_strict_acceptor) {
>+		gss_create_empty_oid_set(&status, &oidset);
>+		gss_add_oid_set_member(&status, ctx->oid, &oidset);
>+
>+		if (gethostname(lname, MAXHOSTNAMELEN)) {
>+			gss_release_oid_set(&status, &oidset);
>+			return (-1);
>+		}
> 
>-	if (gethostname(lname, MAXHOSTNAMELEN)) {
>-		gss_release_oid_set(&status, &oidset);
>-		return (-1);
>-	}
>+		if (GSS_ERROR(ssh_gssapi_import_name(ctx, lname))) {
>+			gss_release_oid_set(&status, &oidset);
>+			return (ctx->major);
>+		}
>+
>+		if ((ctx->major = gss_acquire_cred(&ctx->minor,
>+		    ctx->name, 0, oidset, GSS_C_ACCEPT, &ctx->creds, 
>+		    NULL, NULL)))
>+			ssh_gssapi_error(ctx);
> 
>-	if (GSS_ERROR(ssh_gssapi_import_name(ctx, lname))) {
> 		gss_release_oid_set(&status, &oidset);
> 		return (ctx->major);
>+	} else {
>+		ctx->name = GSS_C_NO_NAME;
>+		ctx->creds = GSS_C_NO_CREDENTIAL;
> 	}
>-
>-	if ((ctx->major = gss_acquire_cred(&ctx->minor,
>-	    ctx->name, 0, oidset, GSS_C_ACCEPT, &ctx->creds, NULL, NULL)))
>-		ssh_gssapi_error(ctx);
>-
>-	gss_release_oid_set(&status, &oidset);
>-	return (ctx->major);
>+	return GSS_S_COMPLETE;
> }
> 
> 
>--- openssh/servconf.h.preaccept	2006-09-10 14:01:31.000000000 +0100
>+++ openssh/servconf.h	2006-09-10 14:28:53.000000000 +0100
>@@ -88,6 +88,7 @@
> 						 * authenticated with Kerberos. */
> 	int     gss_authentication;	/* If true, permit GSSAPI authentication */
> 	int     gss_cleanup_creds;	/* If true, destroy cred cache on logout */
>+	int 	gss_strict_acceptor;	/* If true, restrict the GSSAPI acceptor name */
> 	int     password_authentication;	/* If true, permit password
> 						 * authentication. */
> 	int     kbd_interactive_authentication;	/* If true, permit */
>--- openssh/sshd_config.preaccept	2006-09-10 14:50:48.000000000 +0100
>+++ openssh/sshd_config	2006-09-10 14:54:24.000000000 +0100
>@@ -68,6 +68,7 @@
> # GSSAPI options
> #GSSAPIAuthentication no
> #GSSAPICleanupCredentials yes
>+#GSSAPIStrictAcceptorCheck yes
> 
> # Set this to 'yes' to enable PAM authentication, account processing, 
> # and session processing. If this is enabled, PAM authentication will 
>--- openssh/servconf.c.preaccept	2006-09-10 14:20:41.000000000 +0100
>+++ openssh/servconf.c	2006-09-10 14:55:42.000000000 +0100
>@@ -91,6 +91,7 @@
> 	options->kerberos_get_afs_token = -1;
> 	options->gss_authentication=-1;
> 	options->gss_cleanup_creds = -1;
>+	options->gss_strict_acceptor = -1;
> 	options->password_authentication = -1;
> 	options->kbd_interactive_authentication = -1;
> 	options->challenge_response_authentication = -1;
>@@ -206,6 +207,8 @@
> 		options->gss_authentication = 0;
> 	if (options->gss_cleanup_creds == -1)
> 		options->gss_cleanup_creds = 1;
>+	if (options->gss_strict_acceptor == -1)
>+		options->gss_strict_acceptor = 0;
> 	if (options->password_authentication == -1)
> 		options->password_authentication = 1;
> 	if (options->kbd_interactive_authentication == -1)
>@@ -290,7 +293,8 @@
> 	sBanner, sUseDNS, sHostbasedAuthentication,
> 	sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
> 	sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2,
>-	sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel,
>+	sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor, 
>+	sAcceptEnv, sPermitTunnel,
> 	sMatch, sPermitOpen, sForceCommand,
> 	sUsePrivilegeSeparation,
> 	sDeprecated, sUnsupported
>@@ -351,9 +355,11 @@
> #ifdef GSSAPI
> 	{ "gssapiauthentication", sGssAuthentication, SSHCFG_GLOBAL },
> 	{ "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL },
>+	{ "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL },
> #else
> 	{ "gssapiauthentication", sUnsupported, SSHCFG_GLOBAL },
> 	{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
>+	{ "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL },
> #endif
> 	{ "passwordauthentication", sPasswordAuthentication, SSHCFG_GLOBAL },
> 	{ "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_GLOBAL },
>@@ -876,6 +882,10 @@
> 		intptr = &options->gss_cleanup_creds;
> 		goto parse_flag;
> 
>+	case sGssStrictAcceptor:
>+		intptr = &options->gss_strict_acceptor;
>+		goto parse_flag;
>+
> 	case sPasswordAuthentication:
> 		intptr = &options->password_authentication;
> 		goto parse_flag;
>--- openssh/sshd_config.5.preaccept	2006-09-10 14:21:57.000000000 +0100
>+++ openssh/sshd_config.5	2006-09-10 14:54:56.000000000 +0100
>@@ -326,6 +326,23 @@
> The default is
> .Dq yes .
> Note that this option applies to protocol version 2 only.
>+.It Cm GSSAPIStrictAcceptorCheck
>+Determines whether to be strict about the identity of the GSSAPI acceptor 
>+a client authenticates against. If
>+.Dq yes
>+then the client must authenticate against the
>+.Pa host
>+service on the current hostname. If 
>+.Dq no
>+then the client may authenticate against any service key stored in the 
>+machine's default store. This facility is provided to assist with operation 
>+on multi homed machines. 
>+The default is
>+.Dq yes .
>+Note that this option applies only to protocol version 2 GSSAPI connections,
>+and setting it to 
>+.Dq no
>+may only work with recent Kerberos GSSAPI libraries.
> .It Cm HostbasedAuthentication
> Specifies whether rhosts or /etc/hosts.equiv authentication together
> with successful public key client host authentication is allowed

Actions: View | Diff

Attachments on bug 928: 715 | 1182 | 1775 | 2571