Attachment #2620 for bug #2398

Lines 226-229 int sys_auth_passwd(Authctxt , const char ); Link Here

(-)a/auth.h (+2 lines)
226	#include <krb5.h>	226	#include <krb5.h>
227	krb5_error_code ssh_krb5_cc_gen(krb5_context, krb5_ccache *);	227	krb5_error_code ssh_krb5_cc_gen(krb5_context, krb5_ccache *);
228	#endif	228	#endif
		229
		230	#define METHOD_ANY "any"
229	#endif	231	#endif

Lines 407-413 do_authentication(Authctxt *authctxt) Link Here

(-)a/auth1.c (-1 / +1 lines)
407	}	407	}
408		408
409	/* Configuration may have changed as a result of Match */	409	/* Configuration may have changed as a result of Match */
410	if (options.num_auth_methods != 0)	410	if (strcmp(options.auth_methods[0], METHOD_ANY) != 0)
411	fatal("AuthenticationMethods is not supported with SSH "	411	fatal("AuthenticationMethods is not supported with SSH "
412	"protocol 1");	412	"protocol 1");
413		413




#endif
	}

	if (authenticated && strcmp(options.auth_methods[0], METHOD_ANY) != 0) {
		if (!auth2_update_methods_lists(authctxt, method, submethod)) {
			authenticated = 0;
			partial = 1;

	 * NB. authctxt->num_auth_methods might be zero as a result of
	 * auth2_setup_methods_lists(), so check the configuration.
	 */
	if (strcmp(options.auth_methods[0], METHOD_ANY) == 0)
		return 1;
	for (i = 0; i < authctxt->num_auth_methods; i++) {
		if (list_starts_with(authctxt->auth_methods[i], method,

{
	u_int i;

	if (strcmp(options.auth_methods[0], METHOD_ANY) == 0)
		return 0;
	debug3("%s: checking methods", __func__);
	authctxt->auth_methods = xcalloc(options.num_auth_methods,

Lines 367-373 monitor_child_preauth(Authctxt _authctxt, struct monitor pmonitor) Link Here

(-)a/monitor.c (-1 / +1 lines)
367	authenticated = (monitor_read(pmonitor, mon_dispatch, &ent) == 1);	367	authenticated = (monitor_read(pmonitor, mon_dispatch, &ent) == 1);
368		368
369	/* Special handling for multiple required authentications */	369	/* Special handling for multiple required authentications */
370	if (options.num_auth_methods != 0) {	370	if (strcmp(options.auth_methods[0], METHOD_ANY) != 0) {
371	if (!compat20)	371	if (!compat20)
372	fatal("AuthenticationMethods is not supported"	372	fatal("AuthenticationMethods is not supported"
373	"with SSH protocol 1");	373	"with SSH protocol 1");

Lines 336-341 fill_default_server_options(ServerOptions *options) Link Here

(-)a/servconf.c (+9 lines)
336	options->fwd_opts.streamlocal_bind_unlink = 0;	336	options->fwd_opts.streamlocal_bind_unlink = 0;
337	if (options->fingerprint_hash == -1)	337	if (options->fingerprint_hash == -1)
338	options->fingerprint_hash = SSH_FP_HASH_DEFAULT;	338	options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
		339	if (options->num_auth_methods == 0)
		340	options->auth_methods[options->num_auth_methods++] = strdup(METHOD_ANY);
339	/* Turn privilege separation on by default */	341	/* Turn privilege separation on by default */
340	if (use_privsep == -1)	342	if (use_privsep == -1)
341	use_privsep = PRIVSEP_NOSANDBOX;	343	use_privsep = PRIVSEP_NOSANDBOX;
Lines 1735-1741 process_server_config_line(ServerOptions options, char line, Link Here
1735	break;	1737	break;
1736		1738
1737	case sAuthenticationMethods:	1739	case sAuthenticationMethods:
		1740	if (cp == NULL \|\| *cp == '\0')
		1741	fatal("%.200s line %d: Missing argument.", filename, linenum);
1738	if (options->num_auth_methods == 0) {	1742	if (options->num_auth_methods == 0) {
		1743	if (strcmp(cp, METHOD_ANY) == 0) {
		1744	options->auth_methods[
		1745	options->num_auth_methods++] = xstrdup(strdelim(&cp));
		1746	break;
		1747	}
1739	while ((arg = strdelim(&cp)) && *arg != '\0') {	1748	while ((arg = strdelim(&cp)) && *arg != '\0') {
1740	if (options->num_auth_methods >=	1749	if (options->num_auth_methods >=
1741	MAX_AUTH_METHODS)	1750	MAX_AUTH_METHODS)

Lines 1705-1711 main(int ac, char **av) Link Here

(-)a/sshd.c (-1 / +1 lines)
1705	* daemonisation in the presence of Match block, but this catches	1705	* daemonisation in the presence of Match block, but this catches
1706	* and warns for trivial misconfigurations that could break login.	1706	* and warns for trivial misconfigurations that could break login.
1707	*/	1707	*/
1708	if (options.num_auth_methods != 0) {	1708	if (strcmp(options.auth_methods[0], METHOD_ANY) != 0) {
1709	if ((options.protocol & SSH_PROTO_1))	1709	if ((options.protocol & SSH_PROTO_1))
1710	fatal("AuthenticationMethods is not supported with "	1710	fatal("AuthenticationMethods is not supported with "
1711	"SSH protocol 1");	1711	"SSH protocol 1");

Return to bug 2398

Lines 310-316 userauth_finish(Authctxt authctxt, int authenticated, const char method, Link Here

(-)a/auth2.c (-3 / +3 lines)
310	#endif	310	#endif
311	}	311	}
312		312
313	if (authenticated && options.num_auth_methods != 0) {	313	if (authenticated && strcmp(options.auth_methods[0], METHOD_ANY) != 0) {
314	if (!auth2_update_methods_lists(authctxt, method, submethod)) {	314	if (!auth2_update_methods_lists(authctxt, method, submethod)) {
315	authenticated = 0;	315	authenticated = 0;
316	partial = 1;	316	partial = 1;
Lines 392-398 auth2_method_allowed(Authctxt authctxt, const char method, Link Here
392	* NB. authctxt->num_auth_methods might be zero as a result of	392	* NB. authctxt->num_auth_methods might be zero as a result of
393	* auth2_setup_methods_lists(), so check the configuration.	393	* auth2_setup_methods_lists(), so check the configuration.
394	*/	394	*/
395	if (options.num_auth_methods == 0)	395	if (strcmp(options.auth_methods[0], METHOD_ANY) == 0)
396	return 1;	396	return 1;
397	for (i = 0; i < authctxt->num_auth_methods; i++) {	397	for (i = 0; i < authctxt->num_auth_methods; i++) {
398	if (list_starts_with(authctxt->auth_methods[i], method,	398	if (list_starts_with(authctxt->auth_methods[i], method,
Lines 507-513 auth2_setup_methods_lists(Authctxt *authctxt) Link Here
507	{	507	{
508	u_int i;	508	u_int i;
509		509
510	if (options.num_auth_methods == 0)	510	if (strcmp(options.auth_methods[0], METHOD_ANY) == 0)
511	return 0;	511	return 0;
512	debug3("%s: checking methods", __func__);	512	debug3("%s: checking methods", __func__);
513	authctxt->auth_methods = xcalloc(options.num_auth_methods,	513	authctxt->auth_methods = xcalloc(options.num_auth_methods,