Bug 1113 - Add Interix authentication support
Summary: Add Interix authentication support
Status: CLOSED WONTFIX
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: sshd (show other bugs)
Version: 4.2p1
Hardware: Other Other
: P2 enhancement
Assignee: Assigned to nobody
URL:
Keywords:
Depends on:
Blocks: 1114
  Show dependency treegraph
 
Reported: 2005-11-05 15:20 AEDT by Todd Vierling
Modified: 2021-04-23 14:54 AEST (History)
2 users (show)

See Also:


Attachments
Support for Interix in configure, and authentication support (8.76 KB, patch)
2005-11-05 15:22 AEDT, Todd Vierling
no flags Details | Diff
add null implementations of initgroups and setgroups (1.74 KB, patch)
2005-11-06 18:50 AEDT, Darren Tucker
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Todd Vierling 2005-11-05 15:20:21 AEDT
 
Comment 1 Todd Vierling 2005-11-05 15:22:36 AEDT
Created attachment 1021 [details]
Support for Interix in configure, and authentication support

Interix authentication is a very interesting beast.  Attached are diffs to add an autoconf block for Interix, as well as the necessary authentication bits to make sshd build for non-privsep usage.
Comment 2 Darren Tucker 2005-11-05 16:11:56 AEDT
Comment on attachment 1021 [details]
Support for Interix in configure, and authentication support


>+#ifdef HAVE_INTERIX
>+        result = (!setuser(pw->pw_name, password, SU_CHECK);
>+#else
> 	result = sys_auth_passwd(authctxt, password);
>+#endif

This is exactly the kind of thing the sys_auth_passwd abstraction is designed to avoid.  The correct way to do this is to implement your own sys_auth_passwd() and define CUSTOM_SYS_AUTH_PASSWD.

>+#ifndef HAVE_INTERIX
> 			case ' ':
>+#endif

Why this change?

>+# if !defined(HAVE_INTERIX)
> 		/* Initialize the group list. */
> 		if (initgroups(pw->pw_name, pw->pw_gid) < 0) {
> 			perror("initgroups");
> 			exit(1);
> 		}
>+# endif /* !HAVE_INTERIX */

Does Interix have initgroups()?  If not, just implement initgroups() as a null function that just returns zero.  Ditto setgroups.

>+#ifdef HAVE_INTERIX
>+		use_privsep = 0;
>+#else
> 		use_privsep = 1;
>+#endif

Why doesn't privsep work?  Does defining DISABLE_FD_PASSING make preauth privsep work?  (That's what Cygwin and a number of other platforms do.)
Comment 3 Todd Vierling 2005-11-06 02:42:55 AEDT
> >+#ifdef HAVE_INTERIX
> >+        result = (!setuser(pw->pw_name, password, SU_CHECK);
> >+#else
> > 	result = sys_auth_passwd(authctxt, password);
> >+#endif
> 
> This is exactly the kind of thing the sys_auth_passwd abstraction is designed
> to avoid.  The correct way to do this is to implement your own
> sys_auth_passwd() and define CUSTOM_SYS_AUTH_PASSWD.

Will do, and will resubmit patch at that time.

> >+#ifndef HAVE_INTERIX
> > 			case ' ':
> >+#endif
> 
> Why this change?

Interix users and groups are allowed to have spaces in them.  (This is 
because Interix is a Unix layer on top of Windows, similar to Cygwin but 
working at a much lower NT level.)

> >+# if !defined(HAVE_INTERIX)
> > 		/* Initialize the group list. */
> > 		if (initgroups(pw->pw_name, pw->pw_gid) < 0) {
> > 			perror("initgroups");
> > 			exit(1);
> > 		}
> >+# endif /* !HAVE_INTERIX */
> 
> Does Interix have initgroups()?  If not, just implement initgroups() as a null
> function that just returns zero.  Ditto setgroups.

OK, will do.  There used to be a no-op setgroups() that was used for Cygwin 
too, but it disappeared early in 2005.  I'll have to track back to find 
which portable release had it last, and merge it back in.

> >+#ifdef HAVE_INTERIX
> >+		use_privsep = 0;
> >+#else
> > 		use_privsep = 1;
> >+#endif
> 
> Why doesn't privsep work?  Does defining DISABLE_FD_PASSING make preauth
> privsep work?  (That's what Cygwin and a number of other platforms do.)

I can't remember why this was here, but last time I looked, 
DISABLE_FD_PASSING wasn't enough.  I'll check again and resubmit.
Comment 4 Darren Tucker 2005-11-06 18:50:37 AEDT
Created attachment 1027 [details]
add null implementations of initgroups and setgroups

Since these might be shared, they belong in a common file.  Anything Interix specific (eg the sys_auth_passwd implementation) should go into a "port-interix.c" or similar.
Comment 5 Damien Miller 2018-04-06 14:43:18 AEST
I think this is obsolete with the addition of native windows OpenSSH
Comment 6 Damien Miller 2021-04-23 14:54:57 AEST
closing resolved bugs as of 8.6p1 release