You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
131 lines
5.9 KiB
131 lines
5.9 KiB
diff -up openssh-7.4p1/gss-serv-krb5.c.GSSAPIEnablek5users openssh-7.4p1/gss-serv-krb5.c |
|
--- openssh-7.4p1/gss-serv-krb5.c.GSSAPIEnablek5users 2016-12-23 15:18:40.615216100 +0100 |
|
+++ openssh-7.4p1/gss-serv-krb5.c 2016-12-23 15:18:40.628216102 +0100 |
|
@@ -279,7 +279,6 @@ ssh_gssapi_krb5_cmdok(krb5_principal pri |
|
FILE *fp; |
|
char file[MAXPATHLEN]; |
|
char *line = NULL; |
|
- char kuser[65]; /* match krb5_kuserok() */ |
|
struct stat st; |
|
struct passwd *pw = the_authctxt->pw; |
|
int found_principal = 0; |
|
@@ -288,7 +287,7 @@ ssh_gssapi_krb5_cmdok(krb5_principal pri |
|
|
|
snprintf(file, sizeof(file), "%s/.k5users", pw->pw_dir); |
|
/* If both .k5login and .k5users DNE, self-login is ok. */ |
|
- if (!k5login_exists && (access(file, F_OK) == -1)) { |
|
+ if ( !options.enable_k5users || (!k5login_exists && (access(file, F_OK) == -1))) { |
|
return ssh_krb5_kuserok(krb_context, principal, luser, |
|
k5login_exists); |
|
} |
|
diff -up openssh-7.4p1/servconf.c.GSSAPIEnablek5users openssh-7.4p1/servconf.c |
|
--- openssh-7.4p1/servconf.c.GSSAPIEnablek5users 2016-12-23 15:18:40.615216100 +0100 |
|
+++ openssh-7.4p1/servconf.c 2016-12-23 15:35:36.354401156 +0100 |
|
@@ -168,6 +168,7 @@ initialize_server_options(ServerOptions |
|
options->gss_store_rekey = -1; |
|
options->gss_kex_algorithms = NULL; |
|
options->use_kuserok = -1; |
|
+ options->enable_k5users = -1; |
|
options->password_authentication = -1; |
|
options->kbd_interactive_authentication = -1; |
|
options->permit_empty_passwd = -1; |
|
@@ -345,6 +346,8 @@ fill_default_server_options(ServerOption |
|
#endif |
|
if (options->use_kuserok == -1) |
|
options->use_kuserok = 1; |
|
+ if (options->enable_k5users == -1) |
|
+ options->enable_k5users = 0; |
|
if (options->password_authentication == -1) |
|
options->password_authentication = 1; |
|
if (options->kbd_interactive_authentication == -1) |
|
@@ -418,7 +421,7 @@ typedef enum { |
|
sHostbasedUsesNameFromPacketOnly, sHostbasedAcceptedAlgorithms, |
|
sHostKeyAlgorithms, sPerSourceMaxStartups, sPerSourceNetBlockSize, |
|
sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile, |
|
- sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor, |
|
+ sGssAuthentication, sGssCleanupCreds, sGssEnablek5users, sGssStrictAcceptor, |
|
sGssKeyEx, sGssKexAlgorithms, sGssStoreRekey, |
|
sAcceptEnv, sSetEnv, sPermitTunnel, |
|
sMatch, sPermitOpen, sPermitListen, sForceCommand, sChrootDirectory, |
|
@@ -497,14 +500,16 @@ static struct { |
|
{ "gssapikeyexchange", sGssKeyEx, SSHCFG_GLOBAL }, |
|
{ "gssapistorecredentialsonrekey", sGssStoreRekey, SSHCFG_GLOBAL }, |
|
{ "gssapikexalgorithms", sGssKexAlgorithms, SSHCFG_GLOBAL }, |
|
+ { "gssapienablek5users", sGssEnablek5users, SSHCFG_ALL }, |
|
#else |
|
{ "gssapiauthentication", sUnsupported, SSHCFG_ALL }, |
|
{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL }, |
|
{ "gssapicleanupcreds", sUnsupported, SSHCFG_GLOBAL }, |
|
{ "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL }, |
|
{ "gssapikeyexchange", sUnsupported, SSHCFG_GLOBAL }, |
|
{ "gssapistorecredentialsonrekey", sUnsupported, SSHCFG_GLOBAL }, |
|
{ "gssapikexalgorithms", sUnsupported, SSHCFG_GLOBAL }, |
|
+ { "gssapienablek5users", sUnsupported, SSHCFG_ALL }, |
|
#endif |
|
{ "gssusesessionccache", sUnsupported, SSHCFG_GLOBAL }, |
|
{ "gssapiusesessioncredcache", sUnsupported, SSHCFG_GLOBAL }, |
|
@@ -1653,6 +1658,10 @@ process_server_config_line(ServerOptions |
|
intptr = &options->use_kuserok; |
|
goto parse_flag; |
|
|
|
+ case sGssEnablek5users: |
|
+ intptr = &options->enable_k5users; |
|
+ goto parse_flag; |
|
+ |
|
case sMatch: |
|
if (cmdline) |
|
fatal("Match directive not supported as a command-line " |
|
@@ -2026,6 +2035,7 @@ copy_set_server_options(ServerOptions *d |
|
M_CP_INTOPT(ip_qos_interactive); |
|
M_CP_INTOPT(ip_qos_bulk); |
|
M_CP_INTOPT(use_kuserok); |
|
+ M_CP_INTOPT(enable_k5users); |
|
M_CP_INTOPT(rekey_limit); |
|
M_CP_INTOPT(rekey_interval); |
|
M_CP_INTOPT(log_level); |
|
@@ -2320,6 +2330,7 @@ dump_config(ServerOptions *o) |
|
# endif |
|
dump_cfg_fmtint(sKerberosUniqueCCache, o->kerberos_unique_ccache); |
|
dump_cfg_fmtint(sKerberosUseKuserok, o->use_kuserok); |
|
+ dump_cfg_fmtint(sGssEnablek5users, o->enable_k5users); |
|
#endif |
|
#ifdef GSSAPI |
|
dump_cfg_fmtint(sGssAuthentication, o->gss_authentication); |
|
diff -up openssh-7.4p1/servconf.h.GSSAPIEnablek5users openssh-7.4p1/servconf.h |
|
--- openssh-7.4p1/servconf.h.GSSAPIEnablek5users 2016-12-23 15:18:40.616216100 +0100 |
|
+++ openssh-7.4p1/servconf.h 2016-12-23 15:18:40.629216102 +0100 |
|
@@ -174,6 +174,7 @@ typedef struct { |
|
int kerberos_unique_ccache; /* If true, the acquired ticket will |
|
* be stored in per-session ccache */ |
|
int use_kuserok; |
|
+ int enable_k5users; |
|
int gss_authentication; /* If true, permit GSSAPI authentication */ |
|
int gss_keyex; /* If true, permit GSSAPI key exchange */ |
|
int gss_cleanup_creds; /* If true, destroy cred cache on logout */ |
|
diff -up openssh-7.4p1/sshd_config.5.GSSAPIEnablek5users openssh-7.4p1/sshd_config.5 |
|
--- openssh-7.4p1/sshd_config.5.GSSAPIEnablek5users 2016-12-23 15:18:40.630216103 +0100 |
|
+++ openssh-7.4p1/sshd_config.5 2016-12-23 15:36:21.607408435 +0100 |
|
@@ -628,6 +628,12 @@ Specifies whether to automatically destr |
|
on logout. |
|
The default is |
|
.Cm yes . |
|
+.It Cm GSSAPIEnablek5users |
|
+Specifies whether to look at .k5users file for GSSAPI authentication |
|
+access control. Further details are described in |
|
+.Xr ksu 1 . |
|
+The default is |
|
+.Cm no . |
|
.It Cm GSSAPIKeyExchange |
|
Specifies whether key exchange based on GSSAPI is allowed. GSSAPI key exchange |
|
doesn't rely on ssh keys to verify host identity. |
|
diff -up openssh-7.4p1/sshd_config.GSSAPIEnablek5users openssh-7.4p1/sshd_config |
|
--- openssh-7.4p1/sshd_config.GSSAPIEnablek5users 2016-12-23 15:18:40.616216100 +0100 |
|
+++ openssh-7.4p1/sshd_config 2016-12-23 15:18:40.631216103 +0100 |
|
@@ -80,6 +80,7 @@ GSSAPIAuthentication yes |
|
#GSSAPICleanupCredentials yes |
|
#GSSAPIStrictAcceptorCheck yes |
|
#GSSAPIKeyExchange no |
|
+#GSSAPIEnablek5users no |
|
|
|
# Set this to 'yes' to enable PAM authentication, account processing, |
|
# and session processing. If this is enabled, PAM authentication will
|
|
|