We would like to be able to have tcp wrappers allow ssh access based on ip address groups, rather than names only. This was working as expected for 2.9.9p2 and seems to only allow access by hostname for 3.3p1. I started looking at how we have tcpd compiled, but I don't think that's the problem because this was working fine with the older openssh, but not the new one.
This is what's reported in the syslog from openssh-2.9.9p2 - with an ip address range listed in hosts.allow Jun 25 10:50:08 6D:server sshd[30123536]: Failed keyboard-interactive for ktaylor from xxx.xxx.xxx.xxx port 40333 ssh2 Jun 25 10:50:13 6D:server sshd[30123536]: Accepted password for ktaylor from xxx.xxx.xxx.xxx port 40333 ssh2 With openssh-3.3p1, I don't connect from the client, because I'm being refused from the server: Jun 25 10:52:02 4D:server sshd[30412458]: refused connect from client.com
that's all we changed: packet_set_connection(sock_in, sock_out); remote_port = get_remote_port(); remote_ip = get_remote_ipaddr(); - /* Check whether logins are denied from this host. */ #ifdef LIBWRAP - /* XXX LIBWRAP noes not know about IPv6 */ + /* Check whether logins are denied from this host. */ { struct request_info req; - request_init(&req, RQ_DAEMON, __progname, RQ_FILE, sock_in, NULL); + request_init(&req, RQ_DAEMON, __progname, RQ_FILE, sock_in, 0); fromhost(&req); if (!hosts_access(&req)) { + debug("Connection refused by tcp wrapper"); refuse(&req); - close(sock_in); - close(sock_out); + /* NOTREACHED */ + fatal("libwrap refuse returns"); } -/*XXX IPv6 verbose("Connection from %.500s port %d", eval_client(&req), remote_port); */ } #endif /* LIBWRAP */ + /* Log the connection. */ verbose("Connection from %.500s port %d", remote_ip, remote_port); :
hmm...that's weird. I wonder why the different behavior suddenly.
ok. I think I may be on to a way to get it working. If I compile it on IRIX with the IRIX native compilers (n32 mode), everything is working as it probably should. However, when using gcc 2.95.3 on IRIX, it had the tcp wrapper problem. Why this is an issue at all, I don't know....and way beyond my area of expertise to figure out...and probably not worth the effort. Thanks.
Mass change of RESOLVED bugs to CLOSED