]> git.pld-linux.org Git - packages/openssh.git/blame - openssh-ldap.patch
projects / packages / openssh.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
openssl 3.3.1 rebuild
[packages/openssh.git] / openssh-ldap.patch
CommitLineData
7ae7664a
AM		 1diff -urNp -x '*.orig' openssh-8.4p1.org/HOWTO.ldap-keys openssh-8.4p1/HOWTO.ldap-keys
2--- openssh-8.4p1.org/HOWTO.ldap-keys 1970-01-01 01:00:00.000000000 +0100
3+++ openssh-8.4p1/HOWTO.ldap-keys 2021-03-01 11:29:31.277623165 +0100
501aed94
AM		 4@@ -0,0 +1,108 @@
5+
6+HOW TO START
7+
8+1) configure LDAP server
9+ * Use LDAP server documentation
10+2) add appropriate LDAP schema
11+ * For OpenLDAP or SunONE Use attached schema, otherwise you have to create it.
12+ * LDAP user entry
13+ User entry:
14+ - attached to the 'ldapPublicKey' objectclass
15+ - attached to the 'posixAccount' objectclass
16+ - with a filled 'sshPublicKey' attribute
17+3) insert users into LDAP
18+ * Use LDAP Tree management tool as useful
19+ * Entry in the LDAP server must respect 'posixAccount' and 'ldapPublicKey' which are defined in core.schema and the additionnal lpk.schema.
20+ * Example:
21+ dn: uid=captain,ou=commanders,dc=enterprise,dc=universe
22+ objectclass: top
23+ objectclass: person
24+ objectclass: organizationalPerson
25+ objectclass: posixAccount
26+ objectclass: ldapPublicKey
27+ description: Jonathan Archer
28+ userPassword: Porthos
29+ cn: onathan Archer
30+ sn: onathan Archer
31+ uid: captain
32+ uidNumber: 1001
33+ gidNumber: 1001
34+ homeDirectory: /home/captain
35+ sshPublicKey: ssh-rss AAAAB3.... =captain@universe
36+ sshPublicKey: command="kill -9 1" ssh-rss AAAAM5...
37+4) on the ssh side set in sshd_config
38+ * Set up the backend
3eddefd2
ER		 39+ AuthorizedKeysCommand /usr/libexec/openssh/ssh-ldap-wrapper
40+ AuthorizedKeysCommandUser <appropriate user to run LDAP>
501aed94
AM		 41+ * Do not forget to set
42+ PubkeyAuthentication yes
43+ * Swith off unnecessary auth methods
44+5) confugure ldap.conf
45+ * Default ldap.conf is placed in /etc/ssh
46+ * The configuration style is the same as other ldap based aplications
47+6) if necessary edit ssh-ldap-wrapper
48+ * There is a possibility to change ldap.conf location
49+ * There are some debug options
50+ * Example
51+ /usr/libexec/openssh -s -f /etc/ldap.conf -w -d >> /tmp/ldapdebuglog.txt
52+
53+HOW TO MIGRATE FROM LPK
54+
55+1) goto HOW TO START 4) .... the ldap schema is the same
56+
57+2) convert the group requests to the appropriate LDAP requests
58+
59+HOW TO SOLVE PROBLEMS
60+
61+1) use debug in sshd
62+ * /usr/sbin/sshd -d -d -d -d
63+2) use debug in ssh-ldap-helper
64+ * ssh-ldap-helper -d -d -d -d -s <username>
65+3) use tcpdump ... other ldap client etc.
66+
67+ADVANTAGES
68+
69+1) Blocking an user account can be done directly from LDAP (if sshd is using PubkeyAuthentication + AuthorizedKeysCommand with ldap only).
70+
71+DISADVANTAGES
72+
73+1) LDAP must be well configured, getting the public key of some user is not a problem, but if anonymous LDAP
74+ allows write to users dn, somebody could replace some user's public key by his own and impersonate some
75+ of your users in all your server farm -- be VERY CAREFUL.
76+2) With incomplete PKI the MITM attack when sshd is requesting the public key, could lead to a compromise of your servers allowing login
77+ as the impersonated user.
78+3) If LDAP server is down there may be no fallback on passwd auth.
79+
80+MISC.
81+
82+1) todo
83+ * Possibility to reuse the ssh-ldap-helper.
84+ * Tune the LDAP part to accept all possible LDAP configurations.
85+
86+2) differences from original lpk
87+ * No LDAP code in sshd.
88+ * Support for various LDAP platforms and configurations.
89+ * LDAP is configured in separate ldap.conf file.
90+
91+3) docs/link
92+ * http://pacsec.jp/core05/psj05-barisani-en.pdf
93+ * http://fritz.potsdam.edu/projects/openssh-lpk/
94+ * http://fritz.potsdam.edu/projects/sshgate/
95+ * http://dev.inversepath.com/trac/openssh-lpk
96+ * http://lam.sf.net/ ( http://lam.sourceforge.net/documentation/supportedSchemas.htm )
97+
98+4) contributors/ideas/greets
99+ - Eric AUGE <eau@phear.org>
100+ - Andrea Barisani <andrea@inversepath.com>
101+ - Falk Siemonsmeier.
102+ - Jacob Rief.
103+ - Michael Durchgraf.
104+ - frederic peters.
105+ - Finlay dobbie.
106+ - Stefan Fisher.
107+ - Robin H. Johnson.
108+ - Adrian Bridgett.
109+
110+5) Author
111+ Jan F. Chadima <jchadima@redhat.com>
112+
7ae7664a
AM		 113diff -urNp -x '*.orig' openssh-8.4p1.org/Makefile.in openssh-8.4p1/Makefile.in
114--- openssh-8.4p1.org/Makefile.in 2020-09-27 09:25:01.000000000 +0200
115+++ openssh-8.4p1/Makefile.in 2021-03-01 11:29:31.280956671 +0100
116@@ -23,6 +23,8 @@ SSH_PROGRAM=@bindir@/ssh
117 ASKPASS_PROGRAM=$(libexecdir)/ssh-askpass
118 SFTP_SERVER=$(libexecdir)/sftp-server
119 SSH_KEYSIGN=$(libexecdir)/ssh-keysign
120+SSH_LDAP_HELPER=$(libexecdir)/ssh-ldap-helper
121+SSH_LDAP_WRAPPER=$(libexecdir)/ssh-ldap-wrapper
122 SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
123 SSH_SK_HELPER=$(libexecdir)/ssh-sk-helper
124 PRIVSEP_PATH=@PRIVSEP_PATH@
125@@ -63,10 +65,11 @@ LDFLAGS_NOPIE=-L. -Lopenbsd-compat/ @LDF
126 EXEEXT=@EXEEXT@
127 MANFMT=@MANFMT@
128 MKDIR_P=@MKDIR_P@
129+INSTALL_SSH_LDAP_HELPER=@INSTALL_SSH_LDAP_HELPER@
130
131 .SUFFIXES: .lo
132
133-TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT)
134+TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT) ssh-ldap-helper$(EXEEXT)
135
136 XMSS_OBJS=\
137 ssh-xmss.o \
138@@ -150,8 +153,8 @@ SFTPSERVER_OBJS=sftp-common.o sftp-serve
139
52f772a6 140 SFTP_OBJS= sftp.o sftp-usergroup.o progressmeter.o $(SFTP_CLIENT_OBJS)
7ae7664a
AM		 141
142-MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out ssh-sk-helper.8.out sshd_config.5.out ssh_config.5.out
143-MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 ssh-sk-helper.8 sshd_config.5 ssh_config.5
144+MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out ssh-sk-helper.8.out ssh-ldap-helper.8.out sshd_config.5.out ssh_config.5.out ssh-ldap.conf.5.out
145+MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 ssh-sk-helper.8 ssh-ldap-helper.8 sshd_config.5 ssh_config.5 ssh-ldap.conf.5
146 MANTYPE = @MANTYPE@
147
148 CONFIGFILES=sshd_config.out ssh_config.out moduli.out
149@@ -230,6 +233,9 @@ ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT)
150 ssh-sk-helper$(EXEEXT): $(LIBCOMPAT) libssh.a $(SKHELPER_OBJS)
52f772a6 151 $(LD) -o $@ $(SKHELPER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS) $(LIBFIDO2) $(CHANNELLIBS)
7ae7664a
AM		 152
153+ssh-ldap-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o
154+ $(LD) -o $@ ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)
501aed94 155+
7ae7664a 156 ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHKEYSCAN_OBJS)
52f772a6 157 $(LD) -o $@ $(SSHKEYSCAN_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS) $(CHANNELLIBS)
7ae7664a
AM		 158
159@@ -395,6 +401,10 @@ install-files:
160 $(INSTALL) -m 4711 $(STRIP_OPT) ssh-keysign$(EXEEXT) $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
161 $(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
162 $(INSTALL) -m 0755 $(STRIP_OPT) ssh-sk-helper$(EXEEXT) $(DESTDIR)$(SSH_SK_HELPER)$(EXEEXT)
163+ if test ! -z "$(INSTALL_SSH_LDAP_HELPER)" ; then \
164+ $(INSTALL) -m 0700 $(STRIP_OPT) ssh-ldap-helper $(DESTDIR)$(SSH_LDAP_HELPER) ; \
165+ $(INSTALL) -m 0700 ssh-ldap-wrapper $(DESTDIR)$(SSH_LDAP_WRAPPER) ; \
166+ fi
167 $(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
168 $(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
169 $(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
170@@ -412,6 +422,10 @@ install-files:
171 $(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
172 $(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
173 $(INSTALL) -m 644 ssh-sk-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-sk-helper.8
174+ if test ! -z "$(INSTALL_SSH_LDAP_HELPER)" ; then \
175+ $(INSTALL) -m 644 ssh-ldap-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-ldap-helper.8 ; \
176+ $(INSTALL) -m 644 ssh-ldap.conf.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/ssh-ldap.conf.5 ; \
177+ fi
178
179 install-sysconf:
180 $(MKDIR_P) $(DESTDIR)$(sysconfdir)
181@@ -435,6 +449,13 @@ install-sysconf:
182 else \
183 echo "$(DESTDIR)$(sysconfdir)/moduli already exists, install will not overwrite"; \
184 fi
185+ if test ! -z "$(INSTALL_SSH_LDAP_HELPER)" ; then \
186+ if [ ! -f $(DESTDIR)$(sysconfdir)/ldap.conf ]; then \
187+ $(INSTALL) -m 644 ldap.conf $(DESTDIR)$(sysconfdir)/ldap.conf; \
188+ else \
189+ echo "$(DESTDIR)$(sysconfdir)/ldap.conf already exists, install will not overwrite"; \
190+ fi ; \
191+ fi
192
193 host-key: ssh-keygen$(EXEEXT)
194 @if [ -z "$(DESTDIR)" ] ; then \
195@@ -473,6 +494,8 @@ uninstall:
196 -rm -f $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
197 -rm -f $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
198 -rm -f $(DESTDIR)$(SSH_SK_HELPER)$(EXEEXT)
199+ -rm -f $(DESTDIR)$(SSH_LDAP_HELPER)$(EXEEXT)
200+ -rm -f $(DESTDIR)$(SSH_LDAP_WRAPPER)$(EXEEXT)
201 -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
202 -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
203 -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
204@@ -485,6 +508,7 @@ uninstall:
205 -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
206 -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
207 -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-sk-helper.8
208+ -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-ldap-helper.8
209
210 regress-prep:
211 $(MKDIR_P) `pwd`/regress/unittests/test_helper
212diff -urNp -x '*.orig' openssh-8.4p1.org/configure.ac openssh-8.4p1/configure.ac
213--- openssh-8.4p1.org/configure.ac 2021-03-01 11:29:31.004275724 +0100
214+++ openssh-8.4p1/configure.ac 2021-03-01 11:29:31.277623165 +0100
215@@ -1763,6 +1763,106 @@ AC_COMPILE_IFELSE(
216 CFLAGS="$SAVED_CFLAGS"
217 AC_SUBST([PICFLAG])
218
219+# Check whether user wants LDAP support
220+LDAP_MSG="no"
221+INSTALL_SSH_LDAP_HELPER=""
222+AC_ARG_WITH(ldap,
223+ [ --with-ldap[[=PATH]] Enable LDAP pubkey support (optionally in PATH)],
224+ [
225+ if test "x$withval" != "xno" ; then
501aed94 226+
7ae7664a
AM		 227+ INSTALL_SSH_LDAP_HELPER="yes"
228+ CPPFLAGS="$CPPFLAGS -DLDAP_DEPRECATED"
501aed94 229+
7ae7664a
AM		 230+ if test "x$withval" != "xyes" ; then
231+ CPPFLAGS="$CPPFLAGS -I${withval}/include"
232+ LDFLAGS="$LDFLAGS -L${withval}/lib"
233+ fi
501aed94 234+
7ae7664a
AM		 235+ AC_DEFINE([WITH_LDAP_PUBKEY], 1, [Enable LDAP pubkey support])
236+ LDAP_MSG="yes"
501aed94 237+
7ae7664a
AM		 238+ AC_CHECK_HEADERS(lber.h)
239+ AC_CHECK_HEADERS(ldap.h, , AC_MSG_ERROR(could not locate <ldap.h>))
240+ AC_CHECK_HEADERS(ldap_ssl.h)
501aed94 241+
7ae7664a
AM		 242+ AC_ARG_WITH(ldap-lib,
243+ [ --with-ldap-lib=type select ldap library [auto|netscape5|netscape4|netscape3|umich|openldap]])
3eddefd2 244+
7ae7664a
AM		 245+ if test -z "$with_ldap_lib"; then
246+ with_ldap_lib=auto
247+ fi
3eddefd2 248+
7ae7664a
AM		 249+ if test -z "$found_ldap_lib" -a \( $with_ldap_lib = auto -o $with_ldap_lib = umich -o $with_ldap_lib = openldap \); then
250+ AC_CHECK_LIB(lber, main, LIBS="-llber $LIBS" found_ldap_lib=yes)
251+ AC_CHECK_LIB(ldap, main, LIBS="-lldap $LIBS" found_ldap_lib=yes)
252+ fi
3eddefd2 253+
7ae7664a
AM		 254+ if test -z "$found_ldap_lib" -a \( $with_ldap_lib = auto -o $with_ldap_lib = netscape5 \); then
255+ AC_CHECK_LIB(ldap50, main, LIBS="-lldap50 -lssldap50 -lssl3 -lnss3 -lnspr4 -lprldap50 -lplc4 -lplds4 $LIBS" found_ldap_lib=yes)
256+ fi
3eddefd2 257+
7ae7664a
AM		 258+ if test -z "$found_ldap_lib" -a \( $with_ldap_lib = auto -o $with_ldap_lib = netscape4 \); then
259+ AC_CHECK_LIB(ldapssl41, main, LIBS="-lldapssl41 -lplc3 -lplds3 -lnspr3 $LIBS" found_ldap_lib=yes)
260+ if test -z "$found_ldap_lib"; then
261+ AC_CHECK_LIB(ldapssl40, main, LIBS="-lldapssl40 $LIBS" found_ldap_lib=yes)
262+ fi
263+ if test -z "$found_ldap_lib"; then
264+ AC_CHECK_LIB(ldap41, main, LIBS="-lldap41 $LIBS" found_ldap_lib=yes)
265+ fi
266+ if test -z "$found_ldap_lib"; then
267+ AC_CHECK_LIB(ldap40, main, LIBS="-lldap40 $LIBS" found_ldap_lib=yes)
268+ fi
269+ fi
3eddefd2 270+
7ae7664a
AM		 271+ if test -z "$found_ldap_lib" -a \( $with_ldap_lib = auto -o $with_ldap_lib = netscape3 \); then
272+ AC_CHECK_LIB(ldapssl30, main, LIBS="-lldapssl30 $LIBS" found_ldap_lib=yes)
273+ fi
3eddefd2 274+
7ae7664a
AM		 275+ if test -z "$found_ldap_lib"; then
276+ AC_MSG_ERROR(could not locate a valid LDAP library)
277+ fi
3eddefd2 278+
7ae7664a
AM		 279+ AC_MSG_CHECKING([for working LDAP support])
280+ AC_TRY_COMPILE(
281+ [#include <sys/types.h>
282+ #include <ldap.h>],
283+ [(void)ldap_init(0, 0);],
284+ [AC_MSG_RESULT(yes)],
285+ [
286+ AC_MSG_RESULT(no)
287+ AC_MSG_ERROR([** Incomplete or missing ldap libraries **])
288+ ])
289+ AC_CHECK_FUNCS( \
290+ ldap_init \
291+ ldap_get_lderrno \
292+ ldap_set_lderrno \
293+ ldap_parse_result \
294+ ldap_memfree \
295+ ldap_controls_free \
296+ ldap_set_option \
297+ ldap_get_option \
298+ ldapssl_init \
299+ ldap_start_tls_s \
300+ ldap_pvt_tls_set_option \
301+ ldap_initialize \
302+ )
303+ AC_CHECK_FUNCS(ldap_set_rebind_proc,
304+ AC_MSG_CHECKING([number arguments of ldap_set_rebind_proc])
305+ AC_TRY_COMPILE(
306+ [#include <lber.h>
307+ #include <ldap.h>],
308+ [ldap_set_rebind_proc(0, 0, 0);],
309+ [ac_cv_ldap_set_rebind_proc=3],
310+ [ac_cv_ldap_set_rebind_proc=2])
311+ AC_MSG_RESULT($ac_cv_ldap_set_rebind_proc)
312+ AC_DEFINE(LDAP_SET_REBIND_PROC_ARGS, $ac_cv_ldap_set_rebind_proc, [number arguments of ldap_set_rebind_proc])
313+ )
314+ fi
315+ ]
316+)
317+AC_SUBST(INSTALL_SSH_LDAP_HELPER)
3eddefd2 318+
7ae7664a
AM		 319 dnl Checks for library functions. Please keep in alphabetical order
320 AC_CHECK_FUNCS([ \
321 Blowfish_initstate \
322diff -urNp -x '*.orig' openssh-8.4p1.org/ldap-helper.c openssh-8.4p1/ldap-helper.c
323--- openssh-8.4p1.org/ldap-helper.c 1970-01-01 01:00:00.000000000 +0100
324+++ openssh-8.4p1/ldap-helper.c 2021-03-01 11:29:31.280956671 +0100
05e2835e 325@@ -0,0 +1,156 @@
7ae7664a
AM		 326+/* $OpenBSD: ssh-pka-ldap.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
327+/*
328+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
329+ *
330+ * Redistribution and use in source and binary forms, with or without
331+ * modification, are permitted provided that the following conditions
332+ * are met:
333+ * 1. Redistributions of source code must retain the above copyright
334+ * notice, this list of conditions and the following disclaimer.
335+ * 2. Redistributions in binary form must reproduce the above copyright
336+ * notice, this list of conditions and the following disclaimer in the
337+ * documentation and/or other materials provided with the distribution.
338+ *
339+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
340+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
341+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
342+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
343+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
344+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
345+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
346+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
347+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
348+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
349+ */
3eddefd2 350+
7ae7664a
AM		 351+#include "ldapincludes.h"
352+#include "log.h"
353+#include "misc.h"
354+#include "xmalloc.h"
355+#include "ldapconf.h"
356+#include "ldapbody.h"
05e2835e 357+#include <stdlib.h>
7ae7664a
AM		 358+#include <string.h>
359+#include <unistd.h>
3eddefd2 360+
7ae7664a
AM		 361+static int config_debug = 0;
362+int config_exclusive_config_file = 0;
363+static char *config_file_name = "/etc/ssh/ldap.conf";
364+static char *config_single_user = NULL;
365+static int config_verbose = SYSLOG_LEVEL_VERBOSE;
366+int config_warning_config_file = 0;
367+extern char *__progname;
3eddefd2 368+
7ae7664a
AM		 369+static void
370+usage(void)
371+{
372+ fprintf(stderr, "usage: %s [options]\n",
373+ __progname);
374+ fprintf(stderr, "Options:\n");
375+ fprintf(stderr, " -d Output the log messages to stderr.\n");
376+ fprintf(stderr, " -e Check the config file for unknown commands.\n");
377+ fprintf(stderr, " -f file Use alternate config file (default is /etc/ssh/ldap.conf).\n");
378+ fprintf(stderr, " -s user Do not demonize, send the user's key to stdout.\n");
379+ fprintf(stderr, " -v Increase verbosity of the debug output (implies -d).\n");
380+ fprintf(stderr, " -w Warn on unknown commands in the config file.\n");
381+ exit(1);
382+}
501aed94 383+
7ae7664a
AM		 384+/*
385+ * Main program for the ssh pka ldap agent.
386+ */
501aed94 387+
7ae7664a
AM		 388+int
389+main(int ac, char **av)
390+{
391+ int opt;
392+ FILE *outfile = NULL;
501aed94 393+
7ae7664a 394+ __progname = ssh_get_progname(av[0]);
501aed94 395+
7ae7664a 396+ log_init(__progname, SYSLOG_LEVEL_DEBUG3, SYSLOG_FACILITY_AUTH, 0);
501aed94 397+
7ae7664a
AM		 398+ /*
399+ * Initialize option structure to indicate that no values have been
400+ * set.
401+ */
402+ initialize_options();
501aed94 403+
7ae7664a
AM		 404+ /* Parse command-line arguments. */
405+ while ((opt = getopt(ac, av, "def:s:vw")) != -1) {
406+ switch (opt) {
407+ case 'd':
408+ config_debug = 1;
409+ break;
501aed94 410+
7ae7664a
AM		 411+ case 'e':
412+ config_exclusive_config_file = 1;
413+ config_warning_config_file = 1;
414+ break;
501aed94 415+
7ae7664a
AM		 416+ case 'f':
417+ config_file_name = optarg;
418+ break;
501aed94 419+
7ae7664a
AM		 420+ case 's':
421+ config_single_user = optarg;
422+ outfile = fdopen (dup (fileno (stdout)), "w");
423+ break;
501aed94 424+
7ae7664a
AM		 425+ case 'v':
426+ config_debug = 1;
427+ if (config_verbose < SYSLOG_LEVEL_DEBUG3)
428+ config_verbose++;
429+ break;
430+
431+ case 'w':
432+ config_warning_config_file = 1;
433+ break;
434+
435+ case '?':
436+ default:
437+ usage();
438+ break;
501aed94
AM		 439+ }
440+ }
441+
7ae7664a
AM		 442+ /* Initialize loging */
443+ log_init(__progname, config_verbose, SYSLOG_FACILITY_AUTH, config_debug);
501aed94 444+
7ae7664a
AM		 445+ if (ac != optind)
446+ fatal ("illegal extra parameter %s", av[1]);
501aed94 447+
7ae7664a
AM		 448+ /* Ensure that fds 0 and 2 are open or directed to /dev/null */
449+ if (config_debug == 0)
450+ sanitise_stdfd();
501aed94 451+
7ae7664a
AM		 452+ /* Read config file */
453+ read_config_file(config_file_name);
454+ fill_default_options();
455+ if (config_verbose == SYSLOG_LEVEL_DEBUG3) {
456+ debug3 ("=== Configuration ===");
457+ dump_config();
458+ debug3 ("=== *** ===");
501aed94
AM		 459+ }
460+
7ae7664a
AM		 461+ ldap_checkconfig();
462+ ldap_do_connect();
501aed94 463+
7ae7664a
AM		 464+ if (config_single_user) {
465+ process_user (config_single_user, outfile);
466+ } else {
467+ usage();
468+ fatal ("Not yet implemented");
469+/* TODO
470+ * open unix socket a run the loop on it
471+ */
501aed94
AM		 472+ }
473+
7ae7664a
AM		 474+ ldap_do_close();
475+ return 0;
501aed94
AM		 476+}
477+
7ae7664a
AM		 478+/* Ugly hack */
479+void *buffer_get_string(struct sshbuf *b, u_int *l) { return NULL; }
480+void buffer_put_string(struct sshbuf *b, const void *f, u_int l) {}
501aed94 481+
7ae7664a
AM		 482diff -urNp -x '*.orig' openssh-8.4p1.org/ldap-helper.h openssh-8.4p1/ldap-helper.h
483--- openssh-8.4p1.org/ldap-helper.h 1970-01-01 01:00:00.000000000 +0100
484+++ openssh-8.4p1/ldap-helper.h 2021-03-01 11:29:31.280956671 +0100
485@@ -0,0 +1,32 @@
486+/* $OpenBSD: ldap-helper.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
487+/*
488+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
489+ *
490+ * Redistribution and use in source and binary forms, with or without
491+ * modification, are permitted provided that the following conditions
492+ * are met:
493+ * 1. Redistributions of source code must retain the above copyright
494+ * notice, this list of conditions and the following disclaimer.
495+ * 2. Redistributions in binary form must reproduce the above copyright
496+ * notice, this list of conditions and the following disclaimer in the
497+ * documentation and/or other materials provided with the distribution.
498+ *
499+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
500+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
501+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
502+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
503+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
504+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
505+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
506+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
507+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
508+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
509+ */
501aed94 510+
7ae7664a
AM		 511+#ifndef LDAP_HELPER_H
512+#define LDAP_HELPER_H
501aed94 513+
7ae7664a
AM		 514+extern int config_exclusive_config_file;
515+extern int config_warning_config_file;
501aed94 516+
7ae7664a
AM		 517+#endif /* LDAP_HELPER_H */
518diff -urNp -x '*.orig' openssh-8.4p1.org/ldap.conf openssh-8.4p1/ldap.conf
519--- openssh-8.4p1.org/ldap.conf 1970-01-01 01:00:00.000000000 +0100
520+++ openssh-8.4p1/ldap.conf 2021-03-01 11:29:31.280956671 +0100
521@@ -0,0 +1,88 @@
522+# $Id: openssh-5.5p1-ldap.patch,v 1.3 2010/07/07 13:48:36 jfch2222 Exp $
523+#
524+# This is the example configuration file for the OpenSSH
525+# LDAP backend
526+#
527+# see ssh-ldap.conf(5)
528+#
501aed94 529+
7ae7664a
AM		 530+# URI with your LDAP server name. This allows to use
531+# Unix Domain Sockets to connect to a local LDAP Server.
532+#uri ldap://127.0.0.1/
533+#uri ldaps://127.0.0.1/
534+#uri ldapi://%2fvar%2frun%2fldapi_sock/
535+# Note: %2f encodes the '/' used as directory separator
501aed94 536+
7ae7664a
AM		 537+# Another way to specify your LDAP server is to provide an
538+# host name and the port of our LDAP server. Host name
539+# must be resolvable without using LDAP.
540+# Multiple hosts may be specified, each separated by a
541+# space. How long nss_ldap takes to failover depends on
542+# whether your LDAP client library supports configurable
543+# network or connect timeouts (see bind_timelimit).
544+#host 127.0.0.1
501aed94 545+
7ae7664a
AM		 546+# The port.
547+# Optional: default is 389.
548+#port 389
501aed94 549+
7ae7664a
AM		 550+# The distinguished name to bind to the server with.
551+# Optional: default is to bind anonymously.
552+#binddn cn=openssh_keys,dc=example,dc=org
501aed94 553+
7ae7664a
AM		 554+# The credentials to bind with.
555+# Optional: default is no credential.
556+#bindpw TopSecret
501aed94 557+
7ae7664a
AM		 558+# The distinguished name of the search base.
559+#base dc=example,dc=org
560+
561+# The LDAP version to use (defaults to 3
562+# if supported by client library)
563+#ldap_version 3
501aed94 564+
7ae7664a
AM		 565+# The search scope.
566+#scope sub
567+#scope one
568+#scope base
501aed94 569+
7ae7664a
AM		 570+# Search timelimit
571+#timelimit 30
501aed94 572+
7ae7664a
AM		 573+# Bind/connect timelimit
574+#bind_timelimit 30
501aed94 575+
7ae7664a
AM		 576+# Reconnect policy: hard (default) will retry connecting to
577+# the software with exponential backoff, soft will fail
578+# immediately.
579+#bind_policy hard
501aed94 580+
7ae7664a
AM		 581+# SSL setup, may be implied by URI also.
582+#ssl no
583+#ssl on
584+#ssl start_tls
3eddefd2 585+
7ae7664a
AM		 586+# OpenLDAP SSL options
587+# Require and verify server certificate (yes/no)
588+# Default is to use libldap's default behavior, which can be configured in
589+# /etc/openldap/ldap.conf using the TLS_REQCERT setting. The default for
590+# OpenLDAP 2.0 and earlier is "no", for 2.1 and later is "yes".
591+#tls_checkpeer hard
501aed94 592+
7ae7664a
AM		 593+# CA certificates for server certificate verification
594+# At least one of these are required if tls_checkpeer is "yes"
595+#tls_cacertfile /etc/ssl/ca.cert
596+#tls_cacertdir /etc/pki/tls/certs
501aed94 597+
7ae7664a
AM		 598+# Seed the PRNG if /dev/urandom is not provided
599+#tls_randfile /var/run/egd-pool
501aed94 600+
7ae7664a
AM		 601+# SSL cipher suite
602+# See man ciphers for syntax
603+#tls_ciphers TLSv1
501aed94 604+
7ae7664a
AM		 605+# Client certificate and key
606+# Use these, if your server requires client authentication.
607+#tls_cert
608+#tls_key
501aed94 609+
7ae7664a
AM		 610diff -urNp -x '*.orig' openssh-8.4p1.org/ldapbody.c openssh-8.4p1/ldapbody.c
611--- openssh-8.4p1.org/ldapbody.c 1970-01-01 01:00:00.000000000 +0100
612+++ openssh-8.4p1/ldapbody.c 2021-03-01 11:29:31.280956671 +0100
05e2835e 613@@ -0,0 +1,495 @@
7ae7664a 614+/* $OpenBSD: ldapbody.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
3eddefd2
ER		 615+/*
616+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
617+ *
618+ * Redistribution and use in source and binary forms, with or without
619+ * modification, are permitted provided that the following conditions
620+ * are met:
621+ * 1. Redistributions of source code must retain the above copyright
622+ * notice, this list of conditions and the following disclaimer.
623+ * 2. Redistributions in binary form must reproduce the above copyright
624+ * notice, this list of conditions and the following disclaimer in the
625+ * documentation and/or other materials provided with the distribution.
626+ *
627+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
628+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
629+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
630+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
631+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
632+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
633+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
634+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
635+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
636+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
637+ */
501aed94 638+
3eddefd2 639+#include "ldapincludes.h"
3eddefd2 640+#include "log.h"
3eddefd2
ER		 641+#include "xmalloc.h"
642+#include "ldapconf.h"
7ae7664a
AM		 643+#include "ldapmisc.h"
644+#include "ldapbody.h"
645+#include <stdio.h>
05e2835e 646+#include <stdlib.h>
3eddefd2 647+#include <unistd.h>
501aed94 648+
7ae7664a
AM		 649+#define LDAPSEARCH_FORMAT "(&(objectclass=%s)(objectclass=ldapPublicKey)(uid=%s)%s)"
650+#define PUBKEYATTR "sshPublicKey"
651+#define LDAP_LOGFILE "%s/ldap.%d"
652+
653+static FILE *logfile = NULL;
654+static LDAP *ld;
655+
656+static char *attrs[] = {
657+ PUBKEYATTR,
658+ NULL
659+};
660+
661+void
662+ldap_checkconfig (void)
663+{
664+#ifdef HAVE_LDAP_INITIALIZE
665+ if (options.host == NULL && options.uri == NULL)
666+#else
667+ if (options.host == NULL)
668+#endif
669+ fatal ("missing \"host\" in config file");
670+}
671+
672+#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)
673+static int
674+_rebind_proc (LDAP * ld, LDAP_CONST char *url, int request, ber_int_t msgid)
675+{
676+ struct timeval timeout;
677+ int rc;
678+#if defined(HAVE_LDAP_PARSE_RESULT) && defined(HAVE_LDAP_CONTROLS_FREE)
679+ LDAPMessage *result;
680+#endif /* HAVE_LDAP_PARSE_RESULT && HAVE_LDAP_CONTROLS_FREE */
681+
682+ debug2 ("Doing LDAP rebind to %s", options.binddn);
683+ if (options.ssl == SSL_START_TLS) {
684+ if ((rc = ldap_start_tls_s (ld, NULL, NULL)) != LDAP_SUCCESS) {
685+ error ("ldap_starttls_s: %s", ldap_err2string (rc));
686+ return LDAP_OPERATIONS_ERROR;
687+ }
688+ }
689+
690+#if !defined(HAVE_LDAP_PARSE_RESULT) || !defined(HAVE_LDAP_CONTROLS_FREE)
691+ return ldap_simple_bind_s (ld, options.binddn, options.bindpw);
692+#else
693+ if (ldap_simple_bind(ld, options.binddn, options.bindpw) < 0)
694+ fatal ("ldap_simple_bind %s", ldap_err2string (ldap_get_lderrno (ld, 0, 0)));
695+
696+ timeout.tv_sec = options.bind_timelimit;
697+ timeout.tv_usec = 0;
698+ result = NULL;
699+ if ((rc = ldap_result (ld, msgid, FALSE, &timeout, &result)) < 1) {
700+ error ("ldap_result %s", ldap_err2string (ldap_get_lderrno (ld, 0, 0)));
701+ ldap_msgfree (result);
702+ return LDAP_OPERATIONS_ERROR;
703+ }
704+ debug3 ("LDAP rebind to %s succesfull", options.binddn);
705+ return rc;
706+#endif
707+}
708+#else
709+
710+static int
711+_rebind_proc (LDAP * ld, char **whop, char **credp, int *methodp, int freeit)
712+{
713+ if (freeit)
714+ return LDAP_SUCCESS;
715+
716+ *whop = strdup (options.binddn);
717+ *credp = strdup (options.bindpw);
718+ *methodp = LDAP_AUTH_SIMPLE;
719+ debug2 ("Doing LDAP rebind for %s", *whop);
720+ return LDAP_SUCCESS;
721+}
722+#endif
723+
724+void
725+ldap_do_connect(void)
726+{
727+ int rc, msgid, ld_errno = 0;
728+ struct timeval timeout;
729+#if defined(HAVE_LDAP_PARSE_RESULT) && defined(HAVE_LDAP_CONTROLS_FREE)
730+ int parserc;
731+ LDAPMessage *result;
732+ LDAPControl **controls;
733+ int reconnect = 0;
734+#endif /* HAVE_LDAP_PARSE_RESULT && HAVE_LDAP_CONTROLS_FREE */
735+
736+ debug ("LDAP do connect");
737+
738+retry:
739+ if (reconnect) {
740+ debug3 ("Reconnecting with ld_errno %d", ld_errno);
741+ if (options.bind_policy == 0 ||
742+ (ld_errno != LDAP_SERVER_DOWN && ld_errno != LDAP_TIMEOUT) ||
743+ reconnect > 5)
744+ fatal ("Cannot connect to LDAP server");
745+
746+ if (reconnect > 1)
747+ sleep (reconnect - 1);
748+
749+ if (ld != NULL) {
750+ ldap_unbind (ld);
751+ ld = NULL;
752+ }
753+ logit("reconnecting to LDAP server...");
754+ }
755+
756+ if (ld == NULL) {
757+ int rc;
758+ struct timeval tv;
759+
760+#ifdef HAVE_LDAP_SET_OPTION
761+ if (options.debug > 0) {
762+#ifdef LBER_OPT_LOG_PRINT_FILE
763+ if (options.logdir) {
764+ char *logfilename;
765+ int logfilenamelen;
766+
767+ logfilenamelen = strlen (LDAP_LOGFILE) + strlen ("000000") + strlen (options.logdir);
768+ logfilename = xmalloc (logfilenamelen);
769+ snprintf (logfilename, logfilenamelen, LDAP_LOGFILE, options.logdir, (int) getpid ());
770+ logfilename[logfilenamelen - 1] = 0;
771+ if ((logfile = fopen (logfilename, "a")) == NULL)
772+ fatal ("cannot append to %s: %s", logfilename, strerror (errno));
773+ debug3 ("LDAP debug into %s", logfilename);
774+ free (logfilename);
775+ ber_set_option (NULL, LBER_OPT_LOG_PRINT_FILE, logfile);
776+ }
777+#endif
778+ if (options.debug) {
779+#ifdef LBER_OPT_DEBUG_LEVEL
780+ ber_set_option (NULL, LBER_OPT_DEBUG_LEVEL, &options.debug);
781+#endif /* LBER_OPT_DEBUG_LEVEL */
782+#ifdef LDAP_OPT_DEBUG_LEVEL
783+ (void) ldap_set_option (NULL, LDAP_OPT_DEBUG_LEVEL, &options.debug);
784+#endif /* LDAP_OPT_DEBUG_LEVEL */
785+ debug3 ("Set LDAP debug to %d", options.debug);
786+ }
787+ }
788+#endif /* HAVE_LDAP_SET_OPTION */
789+
790+ ld = NULL;
791+#ifdef HAVE_LDAPSSL_INIT
792+ if (options.host != NULL) {
793+ if (options.ssl_on == SSL_LDAPS) {
794+ if ((rc = ldapssl_client_init (options.sslpath, NULL)) != LDAP_SUCCESS)
795+ fatal ("ldapssl_client_init %s", ldap_err2string (rc));
796+ debug3 ("LDAPssl client init");
797+ }
798+
799+ if (options.ssl_on != SSL_OFF) {
800+ if ((ld = ldapssl_init (options.host, options.port, TRUE)) == NULL)
801+ fatal ("ldapssl_init failed");
802+ debug3 ("LDAPssl init");
803+ }
804+ }
805+#endif /* HAVE_LDAPSSL_INIT */
806+
807+ /* continue with opening */
808+ if (ld == NULL) {
809+#if defined (HAVE_LDAP_START_TLS_S) || (defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_X_TLS))
810+ /* Some global TLS-specific options need to be set before we create our
811+ * session context, so we set them here. */
812+
813+#ifdef LDAP_OPT_X_TLS_RANDOM_FILE
814+ /* rand file */
815+ if (options.tls_randfile != NULL) {
816+ if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_RANDOM_FILE,
817+ options.tls_randfile)) != LDAP_SUCCESS)
818+ fatal ("ldap_set_option(LDAP_OPT_X_TLS_RANDOM_FILE): %s",
819+ ldap_err2string (rc));
820+ debug3 ("Set TLS random file %s", options.tls_randfile);
821+ }
822+#endif /* LDAP_OPT_X_TLS_RANDOM_FILE */
501aed94 823+
7ae7664a
AM		 824+ /* ca cert file */
825+ if (options.tls_cacertfile != NULL) {
826+ if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CACERTFILE,
827+ options.tls_cacertfile)) != LDAP_SUCCESS)
828+ error ("ldap_set_option(LDAP_OPT_X_TLS_CACERTFILE): %s",
829+ ldap_err2string (rc));
830+ debug3 ("Set TLS CA cert file %s ", options.tls_cacertfile);
831+ }
501aed94 832+
7ae7664a
AM		 833+ /* ca cert directory */
834+ if (options.tls_cacertdir != NULL) {
835+ if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CACERTDIR,
836+ options.tls_cacertdir)) != LDAP_SUCCESS)
837+ fatal ("ldap_set_option(LDAP_OPT_X_TLS_CACERTDIR): %s",
838+ ldap_err2string (rc));
839+ debug3 ("Set TLS CA cert dir %s ", options.tls_cacertdir);
840+ }
501aed94 841+
7ae7664a
AM		 842+ /* require cert? */
843+ if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_REQUIRE_CERT,
844+ &options.tls_checkpeer)) != LDAP_SUCCESS)
845+ fatal ("ldap_set_option(LDAP_OPT_X_TLS_REQUIRE_CERT): %s",
846+ ldap_err2string (rc));
847+ debug3 ("Set TLS check peer to %d ", options.tls_checkpeer);
501aed94 848+
7ae7664a
AM		 849+ /* set cipher suite, certificate and private key: */
850+ if (options.tls_ciphers != NULL) {
851+ if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CIPHER_SUITE,
852+ options.tls_ciphers)) != LDAP_SUCCESS)
853+ fatal ("ldap_set_option(LDAP_OPT_X_TLS_CIPHER_SUITE): %s",
854+ ldap_err2string (rc));
855+ debug3 ("Set TLS ciphers to %s ", options.tls_ciphers);
856+ }
501aed94 857+
7ae7664a
AM		 858+ /* cert file */
859+ if (options.tls_cert != NULL) {
860+ if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CERTFILE,
861+ options.tls_cert)) != LDAP_SUCCESS)
862+ fatal ("ldap_set_option(LDAP_OPT_X_TLS_CERTFILE): %s",
863+ ldap_err2string (rc));
864+ debug3 ("Set TLS cert file %s ", options.tls_cert);
865+ }
501aed94 866+
7ae7664a
AM		 867+ /* key file */
868+ if (options.tls_key != NULL) {
869+ if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_KEYFILE,
870+ options.tls_key)) != LDAP_SUCCESS)
871+ fatal ("ldap_set_option(LDAP_OPT_X_TLS_KEYFILE): %s",
872+ ldap_err2string (rc));
873+ debug3 ("Set TLS key file %s ", options.tls_key);
874+ }
875+#endif
876+#ifdef HAVE_LDAP_INITIALIZE
877+ if (options.uri != NULL) {
878+ if ((rc = ldap_initialize (&ld, options.uri)) != LDAP_SUCCESS)
879+ fatal ("ldap_initialize %s", ldap_err2string (rc));
880+ debug3 ("LDAP initialize %s", options.uri);
881+ }
882+ }
883+#endif /* HAVE_LDAP_INTITIALIZE */
501aed94 884+
7ae7664a
AM		 885+ /* continue with opening */
886+ if ((ld == NULL) && (options.host != NULL)) {
887+#ifdef HAVE_LDAP_INIT
888+ if ((ld = ldap_init (options.host, options.port)) == NULL)
889+ fatal ("ldap_init failed");
890+ debug3 ("LDAP init %s:%d", options.host, options.port);
891+#else
892+ if ((ld = ldap_open (options.host, options.port)) == NULL)
893+ fatal ("ldap_open failed");
894+ debug3 ("LDAP open %s:%d", options.host, options.port);
895+#endif /* HAVE_LDAP_INIT */
896+ }
501aed94 897+
7ae7664a
AM		 898+ if (ld == NULL)
899+ fatal ("no way to open ldap");
501aed94 900+
7ae7664a
AM		 901+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_X_TLS)
902+ if (options.ssl == SSL_LDAPS) {
903+ if ((rc = ldap_set_option (ld, LDAP_OPT_X_TLS, &options.tls_checkpeer)) != LDAP_SUCCESS)
904+ fatal ("ldap_set_option(LDAP_OPT_X_TLS) %s", ldap_err2string (rc));
905+ debug3 ("LDAP set LDAP_OPT_X_TLS_%d", options.tls_checkpeer);
906+ }
907+#endif /* LDAP_OPT_X_TLS */
501aed94 908+
7ae7664a
AM		 909+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_PROTOCOL_VERSION)
910+ (void) ldap_set_option (ld, LDAP_OPT_PROTOCOL_VERSION,
911+ &options.ldap_version);
912+#else
913+ ld->ld_version = options.ldap_version;
914+#endif
915+ debug3 ("LDAP set version to %d", options.ldap_version);
501aed94 916+
7ae7664a
AM		 917+#if LDAP_SET_REBIND_PROC_ARGS == 3
918+ ldap_set_rebind_proc (ld, _rebind_proc, NULL);
919+#elif LDAP_SET_REBIND_PROC_ARGS == 2
920+ ldap_set_rebind_proc (ld, _rebind_proc);
921+#else
922+#warning unknown LDAP_SET_REBIND_PROC_ARGS
923+#endif
924+ debug3 ("LDAP set rebind proc");
501aed94 925+
7ae7664a
AM		 926+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_DEREF)
927+ (void) ldap_set_option (ld, LDAP_OPT_DEREF, &options.deref);
928+#else
929+ ld->ld_deref = options.deref;
930+#endif
931+ debug3 ("LDAP set deref to %d", options.deref);
3eddefd2 932+
7ae7664a
AM		 933+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_TIMELIMIT)
934+ (void) ldap_set_option (ld, LDAP_OPT_TIMELIMIT,
935+ &options.timelimit);
936+#else
937+ ld->ld_timelimit = options.timelimit;
938+#endif
939+ debug3 ("LDAP set timelimit to %d", options.timelimit);
501aed94 940+
7ae7664a
AM		 941+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_X_OPT_CONNECT_TIMEOUT)
942+ /*
943+ * This is a new option in the Netscape SDK which sets
944+ * the TCP connect timeout. For want of a better value,
945+ * we use the bind_timelimit to control this.
946+ */
947+ timeout = options.bind_timelimit * 1000;
948+ (void) ldap_set_option (ld, LDAP_X_OPT_CONNECT_TIMEOUT, &timeout);
949+ debug3 ("LDAP set opt connect timeout to %d", timeout);
950+#endif
501aed94 951+
7ae7664a
AM		 952+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_NETWORK_TIMEOUT)
953+ tv.tv_sec = options.bind_timelimit;
954+ tv.tv_usec = 0;
955+ (void) ldap_set_option (ld, LDAP_OPT_NETWORK_TIMEOUT, &tv);
956+ debug3 ("LDAP set opt network timeout to %ld.0", tv.tv_sec);
957+#endif
501aed94 958+
7ae7664a
AM		 959+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_REFERRALS)
960+ (void) ldap_set_option (ld, LDAP_OPT_REFERRALS,
961+ options.referrals ? LDAP_OPT_ON : LDAP_OPT_OFF);
962+ debug3 ("LDAP set referrals to %d", options.referrals);
963+#endif
501aed94 964+
7ae7664a
AM		 965+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_RESTART)
966+ (void) ldap_set_option (ld, LDAP_OPT_RESTART,
967+ options.restart ? LDAP_OPT_ON : LDAP_OPT_OFF);
968+ debug3 ("LDAP set restart to %d", options.restart);
969+#endif
501aed94 970+
7ae7664a
AM		 971+#ifdef HAVE_LDAP_START_TLS_S
972+ if (options.ssl == SSL_START_TLS) {
973+ int version;
501aed94 974+
7ae7664a
AM		 975+ if (ldap_get_option (ld, LDAP_OPT_PROTOCOL_VERSION, &version)
976+ == LDAP_SUCCESS) {
977+ if (version < LDAP_VERSION3) {
978+ version = LDAP_VERSION3;
979+ (void) ldap_set_option (ld, LDAP_OPT_PROTOCOL_VERSION,
980+ &version);
981+ debug3 ("LDAP set version to %d", version);
982+ }
983+ }
501aed94 984+
7ae7664a
AM		 985+ if ((rc = ldap_start_tls_s (ld, NULL, NULL)) != LDAP_SUCCESS)
986+ fatal ("ldap_starttls_s: %s", ldap_err2string (rc));
987+ debug3 ("LDAP start TLS");
988+ }
989+#endif /* HAVE_LDAP_START_TLS_S */
990+ }
501aed94 991+
7ae7664a
AM		 992+ if ((msgid = ldap_simple_bind (ld, options.binddn,
993+ options.bindpw)) == -1) {
994+ ld_errno = ldap_get_lderrno (ld, 0, 0);
501aed94 995+
7ae7664a
AM		 996+ error ("ldap_simple_bind %s", ldap_err2string (ld_errno));
997+ reconnect++;
998+ goto retry;
999+ }
1000+ debug3 ("LDAP simple bind (%s)", options.binddn);
501aed94 1001+
7ae7664a
AM		 1002+ timeout.tv_sec = options.bind_timelimit;
1003+ timeout.tv_usec = 0;
1004+ if ((rc = ldap_result (ld, msgid, FALSE, &timeout, &result)) < 1) {
1005+ ld_errno = ldap_get_lderrno (ld, 0, 0);
501aed94 1006+
7ae7664a
AM		 1007+ error ("ldap_result %s", ldap_err2string (ld_errno));
1008+ reconnect++;
1009+ goto retry;
1010+ }
1011+ debug3 ("LDAP result in time");
501aed94 1012+
7ae7664a
AM		 1013+#if defined(HAVE_LDAP_PARSE_RESULT) && defined(HAVE_LDAP_CONTROLS_FREE)
1014+ controls = NULL;
1015+ if ((parserc = ldap_parse_result (ld, result, &rc, 0, 0, 0, &controls, TRUE)) != LDAP_SUCCESS)
1016+ fatal ("ldap_parse_result %s", ldap_err2string (parserc));
1017+ debug3 ("LDAP parse result OK");
501aed94 1018+
7ae7664a
AM		 1019+ if (controls != NULL) {
1020+ ldap_controls_free (controls);
1021+ }
1022+#else
1023+ rc = ldap_result2error (session->ld, result, TRUE);
1024+#endif
1025+ if (rc != LDAP_SUCCESS)
1026+ fatal ("error trying to bind as user \"%s\" (%s)",
1027+ options.binddn, ldap_err2string (rc));
501aed94 1028+
7ae7664a
AM		 1029+ debug2 ("LDAP do connect OK");
1030+}
501aed94 1031+
7ae7664a
AM		 1032+void
1033+process_user (const char *user, FILE *output)
1034+{
1035+ LDAPMessage *res, *e;
1036+ char *buffer;
1037+ int bufflen, rc, i;
1038+ struct timeval timeout;
501aed94 1039+
7ae7664a 1040+ debug ("LDAP process user");
501aed94 1041+
7ae7664a
AM		 1042+ /* quick check for attempts to be evil */
1043+ if ((strchr(user, '(') != NULL) || (strchr(user, ')') != NULL) ||
1044+ (strchr(user, '*') != NULL) || (strchr(user, '\\') != NULL)) {
1045+ logit ("illegal user name %s not processed", user);
1046+ return;
1047+ }
501aed94 1048+
7ae7664a
AM		 1049+ /* build filter for LDAP request */
1050+ bufflen = strlen (LDAPSEARCH_FORMAT) + strlen(options.account_class) + strlen (user);
1051+ if (options.ssh_filter != NULL)
1052+ bufflen += strlen (options.ssh_filter);
1053+ buffer = xmalloc (bufflen);
1054+ snprintf(buffer, bufflen, LDAPSEARCH_FORMAT, options.account_class, user, (options.ssh_filter != NULL) ? options.ssh_filter : NULL);
1055+ buffer[bufflen - 1] = 0;
501aed94 1056+
7ae7664a 1057+ debug3 ("LDAP search scope = %d %s", options.scope, buffer);
3eddefd2 1058+
7ae7664a
AM		 1059+ timeout.tv_sec = options.timelimit;
1060+ timeout.tv_usec = 0;
1061+ if ((rc = ldap_search_st(ld, options.base, options.scope, buffer, attrs, 0, &timeout, &res)) != LDAP_SUCCESS) {
1062+ error ("ldap_search_st(): %s", ldap_err2string (rc));
1063+ free (buffer);
1064+ return;
1065+ }
501aed94 1066+
7ae7664a
AM		 1067+ /* free */
1068+ free (buffer);
1069+
1070+ for (e = ldap_first_entry(ld, res); e != NULL; e = ldap_next_entry(ld, e)) {
1071+ int num;
1072+ struct berval **keys;
501aed94 1073+
7ae7664a
AM		 1074+ keys = ldap_get_values_len(ld, e, PUBKEYATTR);
1075+ num = ldap_count_values_len(keys);
1076+ for (i = 0 ; i < num ; i++) {
1077+ char *cp; //, *options = NULL;
501aed94 1078+
7ae7664a
AM		 1079+ for (cp = keys[i]->bv_val; *cp == ' ' || *cp == '\t'; cp++);
1080+ if (!*cp || *cp == '\n' || *cp == '#')
1081+ continue;
501aed94 1082+
7ae7664a
AM		 1083+ /* We have found the desired key. */
1084+ fprintf (output, "%s\n", keys[i]->bv_val);
1085+ }
501aed94 1086+
7ae7664a
AM		 1087+ ldap_value_free_len(keys);
1088+ }
501aed94 1089+
7ae7664a
AM		 1090+ ldap_msgfree(res);
1091+ debug2 ("LDAP process user finished");
1092+}
501aed94 1093+
7ae7664a
AM		 1094+void
1095+ldap_do_close(void)
1096+{
1097+ int rc;
501aed94 1098+
7ae7664a
AM		 1099+ debug ("LDAP do close");
1100+ if ((rc = ldap_unbind_ext(ld, NULL, NULL)) != LDAP_SUCCESS)
1101+ fatal ("ldap_unbind_ext: %s",
1102+ ldap_err2string (rc));
501aed94 1103+
7ae7664a
AM		 1104+ ld = NULL;
1105+ debug2 ("LDAP do close OK");
1106+ return;
1107+}
501aed94 1108+
7ae7664a
AM		 1109diff -urNp -x '*.orig' openssh-8.4p1.org/ldapbody.h openssh-8.4p1/ldapbody.h
1110--- openssh-8.4p1.org/ldapbody.h 1970-01-01 01:00:00.000000000 +0100
1111+++ openssh-8.4p1/ldapbody.h 2021-03-01 11:29:31.280956671 +0100
1112@@ -0,0 +1,37 @@
1113+/* $OpenBSD: ldapbody.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
1114+/*
1115+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
1116+ *
1117+ * Redistribution and use in source and binary forms, with or without
1118+ * modification, are permitted provided that the following conditions
1119+ * are met:
1120+ * 1. Redistributions of source code must retain the above copyright
1121+ * notice, this list of conditions and the following disclaimer.
1122+ * 2. Redistributions in binary form must reproduce the above copyright
1123+ * notice, this list of conditions and the following disclaimer in the
1124+ * documentation and/or other materials provided with the distribution.
1125+ *
1126+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
1127+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
1128+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
1129+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
1130+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
1131+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
1132+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
1133+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
1134+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
1135+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1136+ */
501aed94 1137+
7ae7664a
AM		 1138+#ifndef LDAPBODY_H
1139+#define LDAPBODY_H
501aed94 1140+
7ae7664a 1141+#include <stdio.h>
501aed94 1142+
7ae7664a
AM		 1143+void ldap_checkconfig(void);
1144+void ldap_do_connect(void);
1145+void process_user(const char *, FILE *);
1146+void ldap_do_close(void);
501aed94 1147+
7ae7664a 1148+#endif /* LDAPBODY_H */
501aed94 1149+
7ae7664a
AM		 1150diff -urNp -x '*.orig' openssh-8.4p1.org/ldapconf.c openssh-8.4p1/ldapconf.c
1151--- openssh-8.4p1.org/ldapconf.c 1970-01-01 01:00:00.000000000 +0100
1152+++ openssh-8.4p1/ldapconf.c 2021-03-01 11:29:31.280956671 +0100
05e2835e 1153@@ -0,0 +1,692 @@
7ae7664a
AM		 1154+/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
1155+/*
1156+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
1157+ *
1158+ * Redistribution and use in source and binary forms, with or without
1159+ * modification, are permitted provided that the following conditions
1160+ * are met:
1161+ * 1. Redistributions of source code must retain the above copyright
1162+ * notice, this list of conditions and the following disclaimer.
1163+ * 2. Redistributions in binary form must reproduce the above copyright
1164+ * notice, this list of conditions and the following disclaimer in the
1165+ * documentation and/or other materials provided with the distribution.
1166+ *
1167+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
1168+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
1169+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
1170+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
1171+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
1172+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
1173+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
1174+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
1175+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
1176+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1177+ */
1178+
1179+#include "ldapincludes.h"
1180+#include "ldap-helper.h"
1181+#include "log.h"
1182+#include "misc.h"
1183+#include "xmalloc.h"
1184+#include "ldapconf.h"
1185+#include <unistd.h>
05e2835e 1186+#include <stdlib.h>
7ae7664a 1187+#include <string.h>
501aed94 1188+
7ae7664a
AM		 1189+/* Keyword tokens. */
1190+
1191+typedef enum {
1192+ lBadOption,
1193+ lHost, lURI, lBase, lBindDN, lBindPW, lRootBindDN,
1194+ lScope, lDeref, lPort, lTimeLimit, lBind_TimeLimit,
1195+ lLdap_Version, lBind_Policy, lSSLPath, lSSL, lReferrals,
1196+ lRestart, lTLS_CheckPeer, lTLS_CaCertFile,
1197+ lTLS_CaCertDir, lTLS_Ciphers, lTLS_Cert, lTLS_Key,
1198+ lTLS_RandFile, lLogDir, lDebug, lSSH_Filter,
1199+ lAccountClass, lDeprecated, lUnsupported
1200+} OpCodes;
1201+
1202+/* Textual representations of the tokens. */
1203+
1204+static struct {
1205+ const char *name;
1206+ OpCodes opcode;
1207+} keywords[] = {
1208+ { "URI", lURI },
1209+ { "Base", lBase },
1210+ { "BindDN", lBindDN },
1211+ { "BindPW", lBindPW },
1212+ { "RootBindDN", lRootBindDN },
1213+ { "Host", lHost },
1214+ { "Port", lPort },
1215+ { "Scope", lScope },
1216+ { "Deref", lDeref },
1217+ { "TimeLimit", lTimeLimit },
1218+ { "TimeOut", lTimeLimit },
1219+ { "Bind_Timelimit", lBind_TimeLimit },
1220+ { "Network_TimeOut", lBind_TimeLimit },
501aed94 1221+/*
7ae7664a
AM		 1222+ * Todo
1223+ * SIZELIMIT
1224+ */
1225+ { "Ldap_Version", lLdap_Version },
1226+ { "Version", lLdap_Version },
1227+ { "Bind_Policy", lBind_Policy },
1228+ { "SSLPath", lSSLPath },
1229+ { "SSL", lSSL },
1230+ { "Referrals", lReferrals },
1231+ { "Restart", lRestart },
1232+ { "TLS_CheckPeer", lTLS_CheckPeer },
1233+ { "TLS_ReqCert", lTLS_CheckPeer },
1234+ { "TLS_CaCertFile", lTLS_CaCertFile },
1235+ { "TLS_CaCert", lTLS_CaCertFile },
1236+ { "TLS_CaCertDir", lTLS_CaCertDir },
1237+ { "TLS_Ciphers", lTLS_Ciphers },
1238+ { "TLS_Cipher_Suite", lTLS_Ciphers },
1239+ { "TLS_Cert", lTLS_Cert },
1240+ { "TLS_Certificate", lTLS_Cert },
1241+ { "TLS_Key", lTLS_Key },
1242+ { "TLS_RandFile", lTLS_RandFile },
1243+/*
1244+ * Todo
1245+ * TLS_CRLCHECK
1246+ * TLS_CRLFILE
501aed94 1247+ */
7ae7664a
AM		 1248+ { "LogDir", lLogDir },
1249+ { "Debug", lDebug },
1250+ { "SSH_Filter", lSSH_Filter },
1251+ { "AccountClass", lAccountClass },
1252+ { NULL, lBadOption }
1253+};
501aed94 1254+
7ae7664a 1255+/* Configuration ptions. */
501aed94 1256+
7ae7664a 1257+Options options;
501aed94 1258+
7ae7664a
AM		 1259+/*
1260+ * Returns the number of the token pointed to by cp or oBadOption.
1261+ */
501aed94 1262+
7ae7664a
AM		 1263+static OpCodes
1264+parse_token(const char *cp, const char *filename, int linenum)
1265+{
1266+ u_int i;
501aed94 1267+
7ae7664a
AM		 1268+ for (i = 0; keywords[i].name; i++)
1269+ if (strcasecmp(cp, keywords[i].name) == 0)
1270+ return keywords[i].opcode;
1271+
1272+ if (config_warning_config_file)
1273+ logit("%s: line %d: Bad configuration option: %s",
1274+ filename, linenum, cp);
1275+ return lBadOption;
3eddefd2 1276+}
501aed94
AM		 1277+
1278+/*
7ae7664a
AM		 1279+ * Processes a single option line as used in the configuration files. This
1280+ * only sets those values that have not already been set.
501aed94 1281+ */
7ae7664a 1282+#define WHITESPACE " \t\r\n"
501aed94 1283+
7ae7664a
AM		 1284+static int
1285+process_config_line(char *line, const char *filename, int linenum)
501aed94 1286+{
7ae7664a
AM		 1287+ char *s, **charptr, **xstringptr, *endofnumber, *keyword, *arg;
1288+ char *rootbinddn = NULL;
1289+ int opcode, *intptr, value;
1290+ size_t len;
501aed94 1291+
7ae7664a
AM		 1292+ /* Strip trailing whitespace */
1293+ for (len = strlen(line) - 1; len > 0; len--) {
1294+ if (strchr(WHITESPACE, line[len]) == NULL)
1295+ break;
1296+ line[len] = '\0';
1297+ }
501aed94 1298+
7ae7664a
AM		 1299+ s = line;
1300+ /* Get the keyword. (Each line is supposed to begin with a keyword). */
1301+ if ((keyword = strdelim(&s)) == NULL)
1302+ return 0;
1303+ /* Ignore leading whitespace. */
1304+ if (*keyword == '\0')
1305+ keyword = strdelim(&s);
1306+ if (keyword == NULL || !*keyword || *keyword == '\n' || *keyword == '#')
1307+ return 0;
501aed94 1308+
7ae7664a 1309+ opcode = parse_token(keyword, filename, linenum);
501aed94 1310+
7ae7664a
AM		 1311+ switch (opcode) {
1312+ case lBadOption:
1313+ /* don't panic, but count bad options */
1314+ return -1;
1315+ /* NOTREACHED */
501aed94 1316+
7ae7664a
AM		 1317+ case lHost:
1318+ xstringptr = &options.host;
1319+parse_xstring:
1320+ if (!s || *s == '\0')
1321+ fatal("%s line %d: missing dn",filename,linenum);
1322+ if (*xstringptr == NULL)
1323+ *xstringptr = xstrdup(s);
1324+ return 0;
501aed94 1325+
7ae7664a
AM		 1326+ case lURI:
1327+ xstringptr = &options.uri;
1328+ goto parse_xstring;
501aed94 1329+
7ae7664a
AM		 1330+ case lBase:
1331+ xstringptr = &options.base;
1332+ goto parse_xstring;
501aed94 1333+
7ae7664a
AM		 1334+ case lBindDN:
1335+ xstringptr = &options.binddn;
1336+ goto parse_xstring;
501aed94 1337+
7ae7664a
AM		 1338+ case lBindPW:
1339+ charptr = &options.bindpw;
1340+parse_string:
1341+ arg = strdelim(&s);
1342+ if (!arg || *arg == '\0')
1343+ fatal("%.200s line %d: Missing argument.", filename, linenum);
1344+ if (*charptr == NULL)
1345+ *charptr = xstrdup(arg);
1346+ break;
501aed94 1347+
7ae7664a
AM		 1348+ case lRootBindDN:
1349+ xstringptr = &rootbinddn;
1350+ goto parse_xstring;
501aed94 1351+
7ae7664a
AM		 1352+ case lScope:
1353+ intptr = &options.scope;
1354+ arg = strdelim(&s);
1355+ if (!arg || *arg == '\0')
1356+ fatal("%.200s line %d: Missing sub/one/base argument.", filename, linenum);
1357+ value = 0; /* To avoid compiler warning... */
1358+ if (strcasecmp (arg, "sub") == 0 || strcasecmp (arg, "subtree") == 0)
1359+ value = LDAP_SCOPE_SUBTREE;
1360+ else if (strcasecmp (arg, "one") == 0)
1361+ value = LDAP_SCOPE_ONELEVEL;
1362+ else if (strcasecmp (arg, "base") == 0)
1363+ value = LDAP_SCOPE_BASE;
1364+ else
1365+ fatal("%.200s line %d: Bad sub/one/base argument.", filename, linenum);
1366+ if (*intptr == -1)
1367+ *intptr = value;
1368+ break;
501aed94 1369+
7ae7664a
AM		 1370+ case lDeref:
1371+ intptr = &options.scope;
1372+ arg = strdelim(&s);
1373+ if (!arg || *arg == '\0')
1374+ fatal("%.200s line %d: Missing never/searching/finding/always argument.", filename, linenum);
1375+ value = 0; /* To avoid compiler warning... */
1376+ if (!strcasecmp (arg, "never"))
1377+ value = LDAP_DEREF_NEVER;
1378+ else if (!strcasecmp (arg, "searching"))
1379+ value = LDAP_DEREF_SEARCHING;
1380+ else if (!strcasecmp (arg, "finding"))
1381+ value = LDAP_DEREF_FINDING;
1382+ else if (!strcasecmp (arg, "always"))
1383+ value = LDAP_DEREF_ALWAYS;
1384+ else
1385+ fatal("%.200s line %d: Bad never/searching/finding/always argument.", filename, linenum);
1386+ if (*intptr == -1)
1387+ *intptr = value;
1388+ break;
501aed94 1389+
7ae7664a
AM		 1390+ case lPort:
1391+ intptr = &options.port;
1392+parse_int:
1393+ arg = strdelim(&s);
1394+ if (!arg || *arg == '\0')
1395+ fatal("%.200s line %d: Missing argument.", filename, linenum);
1396+ if (arg[0] < '0' || arg[0] > '9')
1397+ fatal("%.200s line %d: Bad number.", filename, linenum);
501aed94 1398+
7ae7664a
AM		 1399+ /* Octal, decimal, or hex format? */
1400+ value = strtol(arg, &endofnumber, 0);
1401+ if (arg == endofnumber)
1402+ fatal("%.200s line %d: Bad number.", filename, linenum);
1403+ if (*intptr == -1)
1404+ *intptr = value;
1405+ break;
501aed94 1406+
7ae7664a
AM		 1407+ case lTimeLimit:
1408+ intptr = &options.timelimit;
1409+parse_time:
1410+ arg = strdelim(&s);
1411+ if (!arg || *arg == '\0')
1412+ fatal("%s line %d: missing time value.",
1413+ filename, linenum);
1414+ if ((value = convtime(arg)) == -1)
1415+ fatal("%s line %d: invalid time value.",
1416+ filename, linenum);
1417+ if (*intptr == -1)
1418+ *intptr = value;
1419+ break;
501aed94 1420+
7ae7664a
AM		 1421+ case lBind_TimeLimit:
1422+ intptr = &options.bind_timelimit;
1423+ goto parse_time;
501aed94 1424+
7ae7664a
AM		 1425+ case lLdap_Version:
1426+ intptr = &options.ldap_version;
1427+ goto parse_int;
501aed94 1428+
7ae7664a
AM		 1429+ case lBind_Policy:
1430+ intptr = &options.bind_policy;
1431+ arg = strdelim(&s);
1432+ if (!arg || *arg == '\0')
1433+ fatal("%.200s line %d: Missing soft/hard argument.", filename, linenum);
1434+ value = 0; /* To avoid compiler warning... */
1435+ if (strcasecmp(arg, "hard") == 0 || strcasecmp(arg, "hard_open") == 0 || strcasecmp(arg, "hard_init") == 0)
1436+ value = 1;
1437+ else if (strcasecmp(arg, "soft") == 0)
1438+ value = 0;
1439+ else
1440+ fatal("%.200s line %d: Bad soft/hard argument.", filename, linenum);
1441+ if (*intptr == -1)
1442+ break;
501aed94 1443+
7ae7664a
AM		 1444+ case lSSLPath:
1445+ charptr = &options.sslpath;
1446+ goto parse_string;
501aed94 1447+
7ae7664a
AM		 1448+ case lSSL:
1449+ intptr = &options.ssl;
1450+ arg = strdelim(&s);
1451+ if (!arg || *arg == '\0')
1452+ fatal("%.200s line %d: Missing yes/no/start_tls argument.", filename, linenum);
1453+ value = 0; /* To avoid compiler warning... */
1454+ if (strcasecmp(arg, "yes") == 0 || strcasecmp(arg, "true") == 0 || strcasecmp(arg, "on") == 0)
1455+ value = SSL_LDAPS;
1456+ else if (strcasecmp(arg, "no") == 0 || strcasecmp(arg, "false") == 0 || strcasecmp(arg, "off") == 0)
1457+ value = SSL_OFF;
1458+ else if (!strcasecmp (arg, "start_tls"))
1459+ value = SSL_START_TLS;
1460+ else
1461+ fatal("%.200s line %d: Bad yes/no/start_tls argument.", filename, linenum);
1462+ if (*intptr == -1)
1463+ *intptr = value;
1464+ break;
501aed94 1465+
7ae7664a
AM		 1466+ case lReferrals:
1467+ intptr = &options.referrals;
1468+parse_flag:
1469+ arg = strdelim(&s);
1470+ if (!arg || *arg == '\0')
1471+ fatal("%.200s line %d: Missing yes/no argument.", filename, linenum);
1472+ value = 0; /* To avoid compiler warning... */
1473+ if (strcasecmp(arg, "yes") == 0 || strcasecmp(arg, "true") == 0 || strcasecmp(arg, "on") == 0)
1474+ value = 1;
1475+ else if (strcasecmp(arg, "no") == 0 || strcasecmp(arg, "false") == 0 || strcasecmp(arg, "off") == 0)
1476+ value = 0;
1477+ else
1478+ fatal("%.200s line %d: Bad yes/no argument.", filename, linenum);
1479+ if (*intptr == -1)
1480+ *intptr = value;
1481+ break;
501aed94 1482+
7ae7664a
AM		 1483+ case lRestart:
1484+ intptr = &options.restart;
1485+ goto parse_flag;
501aed94 1486+
7ae7664a
AM		 1487+ case lTLS_CheckPeer:
1488+ intptr = &options.tls_checkpeer;
1489+ arg = strdelim(&s);
1490+ if (!arg || *arg == '\0')
1491+ fatal("%.200s line %d: Missing never/hard/demand/alow/try argument.", filename, linenum);
1492+ value = 0; /* To avoid compiler warning... */
1493+ if (strcasecmp(arg, "never") == 0 || strcasecmp(arg, "no") == 0 || strcasecmp(arg, "false") == 0 || strcasecmp(arg, "off") == 0)
1494+ value = LDAP_OPT_X_TLS_NEVER;
1495+ else if (strcasecmp(arg, "hard") == 0 || strcasecmp(arg, "yes") == 0 || strcasecmp(arg, "true") == 0 || strcasecmp(arg, "on") == 0)
1496+ value = LDAP_OPT_X_TLS_HARD;
1497+ else if (strcasecmp(arg, "demand") == 0)
1498+ value = LDAP_OPT_X_TLS_DEMAND;
1499+ else if (strcasecmp(arg, "allow") == 0)
1500+ value = LDAP_OPT_X_TLS_ALLOW;
1501+ else if (strcasecmp(arg, "try") == 0)
1502+ value = LDAP_OPT_X_TLS_TRY;
1503+ else
1504+ fatal("%.200s line %d: Bad never/hard/demand/alow/try argument.", filename, linenum);
1505+ if (*intptr == -1)
1506+ break;
501aed94 1507+
7ae7664a
AM		 1508+ case lTLS_CaCertFile:
1509+ charptr = &options.tls_cacertfile;
1510+ goto parse_string;
501aed94 1511+
7ae7664a
AM		 1512+ case lTLS_CaCertDir:
1513+ charptr = &options.tls_cacertdir;
1514+ goto parse_string;
501aed94 1515+
7ae7664a
AM		 1516+ case lTLS_Ciphers:
1517+ xstringptr = &options.tls_ciphers;
1518+ goto parse_xstring;
501aed94 1519+
7ae7664a
AM		 1520+ case lTLS_Cert:
1521+ charptr = &options.tls_cert;
1522+ goto parse_string;
501aed94 1523+
7ae7664a
AM		 1524+ case lTLS_Key:
1525+ charptr = &options.tls_key;
1526+ goto parse_string;
1527+
1528+ case lTLS_RandFile:
1529+ charptr = &options.tls_randfile;
1530+ goto parse_string;
501aed94 1531+
7ae7664a
AM		 1532+ case lLogDir:
1533+ charptr = &options.logdir;
1534+ goto parse_string;
501aed94 1535+
7ae7664a
AM		 1536+ case lDebug:
1537+ intptr = &options.debug;
1538+ goto parse_int;
501aed94 1539+
7ae7664a
AM		 1540+ case lSSH_Filter:
1541+ xstringptr = &options.ssh_filter;
1542+ goto parse_xstring;
501aed94 1543+
7ae7664a
AM		 1544+ case lAccountClass:
1545+ charptr = &options.account_class;
1546+ goto parse_string;
501aed94 1547+
7ae7664a
AM		 1548+ case lDeprecated:
1549+ debug("%s line %d: Deprecated option \"%s\"",
1550+ filename, linenum, keyword);
1551+ return 0;
501aed94 1552+
7ae7664a
AM		 1553+ case lUnsupported:
1554+ error("%s line %d: Unsupported option \"%s\"",
1555+ filename, linenum, keyword);
1556+ return 0;
501aed94 1557+
7ae7664a
AM		 1558+ default:
1559+ fatal("process_config_line: Unimplemented opcode %d", opcode);
1560+ }
501aed94 1561+
7ae7664a
AM		 1562+ /* Check that there is no garbage at end of line. */
1563+ if ((arg = strdelim(&s)) != NULL && *arg != '\0') {
1564+ fatal("%.200s line %d: garbage at end of line; \"%.200s\".",
1565+ filename, linenum, arg);
1566+ }
1567+ return 0;
1568+}
501aed94 1569+
7ae7664a
AM		 1570+/*
1571+ * Reads the config file and modifies the options accordingly. Options
1572+ * should already be initialized before this call. This never returns if
1573+ * there is an error. If the file does not exist, this returns 0.
1574+ */
501aed94 1575+
7ae7664a
AM		 1576+void
1577+read_config_file(const char *filename)
1578+{
1579+ FILE *f;
1580+ char line[1024];
1581+ int active, linenum;
1582+ int bad_options = 0;
1583+ struct stat sb;
501aed94 1584+
7ae7664a
AM		 1585+ if ((f = fopen(filename, "r")) == NULL)
1586+ fatal("fopen %s: %s", filename, strerror(errno));
501aed94 1587+
7ae7664a
AM		 1588+ if (fstat(fileno(f), &sb) == -1)
1589+ fatal("fstat %s: %s", filename, strerror(errno));
1590+ if (((sb.st_uid != 0 && sb.st_uid != getuid()) ||
1591+ (sb.st_mode & 022) != 0))
1592+ fatal("Bad owner or permissions on %s", filename);
501aed94 1593+
7ae7664a 1594+ debug("Reading configuration data %.200s", filename);
501aed94 1595+
7ae7664a
AM		 1596+ /*
1597+ * Mark that we are now processing the options. This flag is turned
1598+ * on/off by Host specifications.
1599+ */
1600+ active = 1;
1601+ linenum = 0;
1602+ while (fgets(line, sizeof(line), f)) {
1603+ /* Update line number counter. */
1604+ linenum++;
1605+ if (process_config_line(line, filename, linenum) != 0)
1606+ bad_options++;
1607+ }
1608+ fclose(f);
1609+ if ((bad_options > 0) && config_exclusive_config_file)
1610+ fatal("%s: terminating, %d bad configuration options",
1611+ filename, bad_options);
1612+}
501aed94 1613+
7ae7664a
AM		 1614+/*
1615+ * Initializes options to special values that indicate that they have not yet
1616+ * been set. Read_config_file will only set options with this value. Options
1617+ * are processed in the following order: command line, user config file,
1618+ * system config file. Last, fill_default_options is called.
1619+ */
501aed94 1620+
7ae7664a
AM		 1621+void
1622+initialize_options(void)
1623+{
1624+ memset(&options, 'X', sizeof(options));
1625+ options.host = NULL;
1626+ options.uri = NULL;
1627+ options.base = NULL;
1628+ options.binddn = NULL;
1629+ options.bindpw = NULL;
1630+ options.scope = -1;
1631+ options.deref = -1;
1632+ options.port = -1;
1633+ options.timelimit = -1;
1634+ options.bind_timelimit = -1;
1635+ options.ldap_version = -1;
1636+ options.bind_policy = -1;
1637+ options.sslpath = NULL;
1638+ options.ssl = -1;
1639+ options.referrals = -1;
1640+ options.restart = -1;
1641+ options.tls_checkpeer = -1;
1642+ options.tls_cacertfile = NULL;
1643+ options.tls_cacertdir = NULL;
1644+ options.tls_ciphers = NULL;
1645+ options.tls_cert = NULL;
1646+ options.tls_key = NULL;
1647+ options.tls_randfile = NULL;
1648+ options.logdir = NULL;
1649+ options.debug = -1;
1650+ options.ssh_filter = NULL;
1651+ options.account_class = NULL;
1652+}
501aed94
AM		 1653+
1654+/*
7ae7664a
AM		 1655+ * Called after processing other sources of option data, this fills those
1656+ * options for which no value has been specified with their default values.
501aed94
AM		 1657+ */
1658+
7ae7664a
AM		 1659+void
1660+fill_default_options(void)
1661+{
1662+ if (options.uri != NULL) {
1663+ LDAPURLDesc *ludp;
1664+
1665+ if (ldap_url_parse(options.uri, &ludp) == LDAP_SUCCESS) {
1666+ if (options.ssl == -1) {
1667+ if (strcmp (ludp->lud_scheme, "ldap") == 0)
1668+ options.ssl = 2;
1669+ if (strcmp (ludp->lud_scheme, "ldapi") == 0)
1670+ options.ssl = 0;
1671+ else if (strcmp (ludp->lud_scheme, "ldaps") == 0)
1672+ options.ssl = 1;
1673+ }
1674+ if (options.host == NULL)
1675+ options.host = xstrdup (ludp->lud_host);
1676+ if (options.port == -1)
1677+ options.port = ludp->lud_port;
1678+
1679+ ldap_free_urldesc (ludp);
1680+ }
1681+ }
1682+ if (options.ssl == -1)
1683+ options.ssl = SSL_START_TLS;
1684+ if (options.port == -1)
1685+ options.port = (options.ssl == 0) ? 389 : 636;
1686+ if (options.uri == NULL) {
1687+ int len;
1688+#define MAXURILEN 4096
1689+
1690+ options.uri = xmalloc (MAXURILEN);
1691+ len = snprintf (options.uri, MAXURILEN, "ldap%s://%s:%d",
1692+ (options.ssl == 0) ? "" : "s", options.host, options.port);
1693+ options.uri[MAXURILEN - 1] = 0;
1694+ options.uri = xreallocarray (options.uri, len + 1, 1);
1695+ }
1696+ if (options.binddn == NULL)
1697+ options.binddn = "";
1698+ if (options.bindpw == NULL)
1699+ options.bindpw = "";
1700+ if (options.scope == -1)
1701+ options.scope = LDAP_SCOPE_SUBTREE;
1702+ if (options.deref == -1)
1703+ options.deref = LDAP_DEREF_NEVER;
1704+ if (options.timelimit == -1)
1705+ options.timelimit = 10;
1706+ if (options.bind_timelimit == -1)
1707+ options.bind_timelimit = 10;
1708+ if (options.ldap_version == -1)
1709+ options.ldap_version = 3;
1710+ if (options.bind_policy == -1)
1711+ options.bind_policy = 1;
1712+ if (options.referrals == -1)
1713+ options.referrals = 1;
1714+ if (options.restart == -1)
1715+ options.restart = 1;
1716+ if (options.tls_checkpeer == -1)
1717+ options.tls_checkpeer = LDAP_OPT_X_TLS_HARD;
1718+ if (options.debug == -1)
1719+ options.debug = 0;
1720+ if (options.ssh_filter == NULL)
1721+ options.ssh_filter = "";
1722+ if (options.account_class == NULL)
1723+ options.account_class = "posixAccount";
1724+}
501aed94 1725+
7ae7664a
AM		 1726+static const char *
1727+lookup_opcode_name(OpCodes code)
1728+{
1729+ u_int i;
1730+
1731+ for (i = 0; keywords[i].name != NULL; i++)
1732+ if (keywords[i].opcode == code)
1733+ return(keywords[i].name);
1734+ return "UNKNOWN";
1735+}
501aed94
AM		 1736+
1737+static void
7ae7664a 1738+dump_cfg_string(OpCodes code, const char *val)
501aed94 1739+{
7ae7664a
AM		 1740+ if (val == NULL)
1741+ debug3("%s <UNDEFINED>", lookup_opcode_name(code));
1742+ else
1743+ debug3("%s %s", lookup_opcode_name(code), val);
501aed94
AM		 1744+}
1745+
7ae7664a
AM		 1746+static void
1747+dump_cfg_int(OpCodes code, int val)
501aed94 1748+{
7ae7664a
AM		 1749+ if (val == -1)
1750+ debug3("%s <UNDEFINED>", lookup_opcode_name(code));
1751+ else
1752+ debug3("%s %d", lookup_opcode_name(code), val);
1753+}
3eddefd2 1754+
7ae7664a
AM		 1755+struct names {
1756+ int value;
1757+ char *name;
1758+};
3eddefd2 1759+
7ae7664a
AM		 1760+static void
1761+dump_cfg_namedint(OpCodes code, int val, struct names *names)
1762+{
1763+ u_int i;
3eddefd2 1764+
7ae7664a
AM		 1765+ if (val == -1)
1766+ debug3("%s <UNDEFINED>", lookup_opcode_name(code));
1767+ else {
1768+ for (i = 0; names[i].value != -1; i++)
1769+ if (names[i].value == val) {
1770+ debug3("%s %s", lookup_opcode_name(code), names[i].name);
1771+ return;
501aed94 1772+ }
7ae7664a 1773+ debug3("%s unknown: %d", lookup_opcode_name(code), val);
501aed94 1774+ }
7ae7664a 1775+}
501aed94 1776+
7ae7664a
AM		 1777+static struct names _yesnotls[] = {
1778+ { 0, "No" },
1779+ { 1, "Yes" },
1780+ { 2, "Start_TLS" },
1781+ { -1, NULL }};
501aed94 1782+
7ae7664a
AM		 1783+static struct names _scope[] = {
1784+ { LDAP_SCOPE_BASE, "Base" },
1785+ { LDAP_SCOPE_ONELEVEL, "One" },
1786+ { LDAP_SCOPE_SUBTREE, "Sub"},
1787+ { -1, NULL }};
501aed94 1788+
7ae7664a
AM		 1789+static struct names _deref[] = {
1790+ { LDAP_DEREF_NEVER, "Never" },
1791+ { LDAP_DEREF_SEARCHING, "Searching" },
1792+ { LDAP_DEREF_FINDING, "Finding" },
1793+ { LDAP_DEREF_ALWAYS, "Always" },
1794+ { -1, NULL }};
501aed94 1795+
7ae7664a
AM		 1796+static struct names _yesno[] = {
1797+ { 0, "No" },
1798+ { 1, "Yes" },
1799+ { -1, NULL }};
501aed94 1800+
7ae7664a
AM		 1801+static struct names _bindpolicy[] = {
1802+ { 0, "Soft" },
1803+ { 1, "Hard" },
1804+ { -1, NULL }};
501aed94 1805+
7ae7664a
AM		 1806+static struct names _checkpeer[] = {
1807+ { LDAP_OPT_X_TLS_NEVER, "Never" },
1808+ { LDAP_OPT_X_TLS_HARD, "Hard" },
1809+ { LDAP_OPT_X_TLS_DEMAND, "Demand" },
1810+ { LDAP_OPT_X_TLS_ALLOW, "Allow" },
1811+ { LDAP_OPT_X_TLS_TRY, "TRY" },
1812+ { -1, NULL }};
501aed94 1813+
7ae7664a
AM		 1814+void
1815+dump_config(void)
1816+{
1817+ dump_cfg_string(lURI, options.uri);
1818+ dump_cfg_string(lHost, options.host);
1819+ dump_cfg_int(lPort, options.port);
1820+ dump_cfg_namedint(lSSL, options.ssl, _yesnotls);
1821+ dump_cfg_int(lLdap_Version, options.ldap_version);
1822+ dump_cfg_int(lTimeLimit, options.timelimit);
1823+ dump_cfg_int(lBind_TimeLimit, options.bind_timelimit);
1824+ dump_cfg_string(lBase, options.base);
1825+ dump_cfg_string(lBindDN, options.binddn);
1826+ dump_cfg_string(lBindPW, options.bindpw);
1827+ dump_cfg_namedint(lScope, options.scope, _scope);
1828+ dump_cfg_namedint(lDeref, options.deref, _deref);
1829+ dump_cfg_namedint(lReferrals, options.referrals, _yesno);
1830+ dump_cfg_namedint(lRestart, options.restart, _yesno);
1831+ dump_cfg_namedint(lBind_Policy, options.bind_policy, _bindpolicy);
1832+ dump_cfg_string(lSSLPath, options.sslpath);
1833+ dump_cfg_namedint(lTLS_CheckPeer, options.tls_checkpeer, _checkpeer);
1834+ dump_cfg_string(lTLS_CaCertFile, options.tls_cacertfile);
1835+ dump_cfg_string(lTLS_CaCertDir, options.tls_cacertdir);
1836+ dump_cfg_string(lTLS_Ciphers, options.tls_ciphers);
1837+ dump_cfg_string(lTLS_Cert, options.tls_cert);
1838+ dump_cfg_string(lTLS_Key, options.tls_key);
1839+ dump_cfg_string(lTLS_RandFile, options.tls_randfile);
1840+ dump_cfg_string(lLogDir, options.logdir);
1841+ dump_cfg_int(lDebug, options.debug);
1842+ dump_cfg_string(lSSH_Filter, options.ssh_filter);
1843+ dump_cfg_string(lAccountClass, options.logdir);
501aed94
AM		 1844+}
1845+
7ae7664a
AM		 1846diff -urNp -x '*.orig' openssh-8.4p1.org/ldapconf.h openssh-8.4p1/ldapconf.h
1847--- openssh-8.4p1.org/ldapconf.h 1970-01-01 01:00:00.000000000 +0100
1848+++ openssh-8.4p1/ldapconf.h 2021-03-01 11:29:31.280956671 +0100
1849@@ -0,0 +1,72 @@
1850+/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
501aed94
AM		 1851+/*
1852+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
1853+ *
1854+ * Redistribution and use in source and binary forms, with or without
1855+ * modification, are permitted provided that the following conditions
1856+ * are met:
1857+ * 1. Redistributions of source code must retain the above copyright
1858+ * notice, this list of conditions and the following disclaimer.
1859+ * 2. Redistributions in binary form must reproduce the above copyright
1860+ * notice, this list of conditions and the following disclaimer in the
1861+ * documentation and/or other materials provided with the distribution.
1862+ *
1863+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
1864+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
1865+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
1866+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
1867+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
1868+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
1869+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
1870+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
1871+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
1872+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1873+ */
1874+
7ae7664a
AM		 1875+#ifndef LDAPCONF_H
1876+#define LDAPCONF_H
501aed94 1877+
7ae7664a
AM		 1878+#define SSL_OFF 0
1879+#define SSL_LDAPS 1
1880+#define SSL_START_TLS 2
1881+
1882+/* Data structure for representing option data. */
1883+
1884+typedef struct {
1885+ char *host;
1886+ char *uri;
1887+ char *base;
1888+ char *binddn;
1889+ char *bindpw;
1890+ int scope;
1891+ int deref;
1892+ int port;
1893+ int timelimit;
1894+ int bind_timelimit;
1895+ int ldap_version;
1896+ int bind_policy;
1897+ char *sslpath;
1898+ int ssl;
1899+ int referrals;
1900+ int restart;
1901+ int tls_checkpeer;
1902+ char *tls_cacertfile;
1903+ char *tls_cacertdir;
1904+ char *tls_ciphers;
1905+ char *tls_cert;
1906+ char *tls_key;
1907+ char *tls_randfile;
1908+ char *logdir;
1909+ int debug;
1910+ char *ssh_filter;
1911+ char *account_class;
1912+} Options;
1913+
1914+extern Options options;
1915+
1916+void read_config_file(const char *);
1917+void initialize_options(void);
1918+void fill_default_options(void);
1919+void dump_config(void);
3eddefd2 1920+
7ae7664a
AM		 1921+#endif /* LDAPCONF_H */
1922diff -urNp -x '*.orig' openssh-8.4p1.org/ldapincludes.h openssh-8.4p1/ldapincludes.h
1923--- openssh-8.4p1.org/ldapincludes.h 1970-01-01 01:00:00.000000000 +0100
1924+++ openssh-8.4p1/ldapincludes.h 2021-03-01 11:29:31.280956671 +0100
501aed94
AM		 1925@@ -0,0 +1,41 @@
1926+/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
1927+/*
1928+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
1929+ *
1930+ * Redistribution and use in source and binary forms, with or without
1931+ * modification, are permitted provided that the following conditions
1932+ * are met:
1933+ * 1. Redistributions of source code must retain the above copyright
1934+ * notice, this list of conditions and the following disclaimer.
1935+ * 2. Redistributions in binary form must reproduce the above copyright
1936+ * notice, this list of conditions and the following disclaimer in the
1937+ * documentation and/or other materials provided with the distribution.
1938+ *
1939+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
1940+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
1941+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
1942+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
1943+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
1944+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
1945+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
1946+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
1947+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
1948+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1949+ */
1950+
1951+#ifndef LDAPINCLUDES_H
1952+#define LDAPINCLUDES_H
1953+
1954+#include "includes.h"
1955+
1956+#ifdef HAVE_LBER_H
1957+#include <lber.h>
1958+#endif
1959+#ifdef HAVE_LDAP_H
1960+#include <ldap.h>
1961+#endif
1962+#ifdef HAVE_LDAP_SSL_H
1963+#include <ldap_ssl.h>
1964+#endif
1965+
1966+#endif /* LDAPINCLUDES_H */
7ae7664a
AM		 1967diff -urNp -x '*.orig' openssh-8.4p1.org/ldapmisc.c openssh-8.4p1/ldapmisc.c
1968--- openssh-8.4p1.org/ldapmisc.c 1970-01-01 01:00:00.000000000 +0100
1969+++ openssh-8.4p1/ldapmisc.c 2021-03-01 11:29:31.280956671 +0100
501aed94
AM		 1970@@ -0,0 +1,79 @@
1971+
1972+#include "ldapincludes.h"
1973+#include "ldapmisc.h"
1974+
1975+#ifndef HAVE_LDAP_GET_LDERRNO
1976+int
1977+ldap_get_lderrno (LDAP * ld, char **m, char **s)
1978+{
1979+#ifdef HAVE_LDAP_GET_OPTION
1980+ int rc;
1981+#endif
1982+ int lderrno;
1983+
1984+#if defined(HAVE_LDAP_GET_OPTION) && defined(LDAP_OPT_ERROR_NUMBER)
1985+ if ((rc = ldap_get_option (ld, LDAP_OPT_ERROR_NUMBER, &lderrno)) != LDAP_SUCCESS)
1986+ return rc;
1987+#else
1988+ lderrno = ld->ld_errno;
1989+#endif
1990+
1991+ if (s != NULL) {
1992+#if defined(HAVE_LDAP_GET_OPTION) && defined(LDAP_OPT_ERROR_STRING)
1993+ if ((rc = ldap_get_option (ld, LDAP_OPT_ERROR_STRING, s)) != LDAP_SUCCESS)
1994+ return rc;
1995+#else
1996+ *s = ld->ld_error;
1997+#endif
1998+ }
1999+
2000+ if (m != NULL) {
2001+#if defined(HAVE_LDAP_GET_OPTION) && defined(LDAP_OPT_MATCHED_DN)
2002+ if ((rc = ldap_get_option (ld, LDAP_OPT_MATCHED_DN, m)) != LDAP_SUCCESS)
2003+ return rc;
2004+#else
2005+ *m = ld->ld_matched;
2006+#endif
2007+ }
2008+
2009+ return lderrno;
2010+}
2011+#endif
2012+
2013+#ifndef HAVE_LDAP_SET_LDERRNO
2014+int
2015+ldap_set_lderrno (LDAP * ld, int lderrno, const char *m, const char *s)
2016+{
2017+#ifdef HAVE_LDAP_SET_OPTION
2018+ int rc;
2019+#endif
2020+
2021+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_ERROR_NUMBER)
2022+ if ((rc = ldap_set_option (ld, LDAP_OPT_ERROR_NUMBER, &lderrno)) != LDAP_SUCCESS)
2023+ return rc;
2024+#else
2025+ ld->ld_errno = lderrno;
2026+#endif
2027+
2028+ if (s != NULL) {
2029+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_ERROR_STRING)
2030+ if ((rc = ldap_set_option (ld, LDAP_OPT_ERROR_STRING, s)) != LDAP_SUCCESS)
2031+ return rc;
2032+#else
2033+ ld->ld_error = s;
2034+#endif
2035+ }
2036+
2037+ if (m != NULL) {
2038+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_MATCHED_DN)
2039+ if ((rc = ldap_set_option (ld, LDAP_OPT_MATCHED_DN, m)) != LDAP_SUCCESS)
2040+ return rc;
2041+#else
2042+ ld->ld_matched = m;
2043+#endif
2044+ }
2045+
2046+ return LDAP_SUCCESS;
2047+}
2048+#endif
2049+
7ae7664a
AM		 2050diff -urNp -x '*.orig' openssh-8.4p1.org/ldapmisc.h openssh-8.4p1/ldapmisc.h
2051--- openssh-8.4p1.org/ldapmisc.h 1970-01-01 01:00:00.000000000 +0100
2052+++ openssh-8.4p1/ldapmisc.h 2021-03-01 11:29:31.280956671 +0100
501aed94
AM		 2053@@ -0,0 +1,35 @@
2054+/* $OpenBSD: ldapbody.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
2055+/*
2056+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
2057+ *
2058+ * Redistribution and use in source and binary forms, with or without
2059+ * modification, are permitted provided that the following conditions
2060+ * are met:
2061+ * 1. Redistributions of source code must retain the above copyright
2062+ * notice, this list of conditions and the following disclaimer.
2063+ * 2. Redistributions in binary form must reproduce the above copyright
2064+ * notice, this list of conditions and the following disclaimer in the
2065+ * documentation and/or other materials provided with the distribution.
2066+ *
2067+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
2068+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
2069+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
2070+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
2071+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
2072+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
2073+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
2074+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
2075+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
2076+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
2077+ */
2078+
2079+#ifndef LDAPMISC_H
2080+#define LDAPMISC_H
2081+
2082+#include "ldapincludes.h"
2083+
2084+int ldap_get_lderrno (LDAP *, char **, char **);
2085+int ldap_set_lderrno (LDAP *, int, const char *, const char *);
2086+
2087+#endif /* LDAPMISC_H */
2088+
7ae7664a
AM		 2089diff -urNp -x '*.orig' openssh-8.4p1.org/openssh-lpk-openldap.schema openssh-8.4p1/openssh-lpk-openldap.schema
2090--- openssh-8.4p1.org/openssh-lpk-openldap.schema 1970-01-01 01:00:00.000000000 +0100
2091+++ openssh-8.4p1/openssh-lpk-openldap.schema 2021-03-01 11:29:31.280956671 +0100
501aed94
AM		 2092@@ -0,0 +1,21 @@
2093+#
2094+# LDAP Public Key Patch schema for use with openssh-ldappubkey
2095+# useful with PKA-LDAP also
2096+#
2097+# Author: Eric AUGE <eau@phear.org>
2098+#
2099+# Based on the proposal of : Mark Ruijter
2100+#
2101+
2102+
2103+# octetString SYNTAX
2104+attributetype ( 1.3.6.1.4.1.24552.500.1.1.1.13 NAME 'sshPublicKey'
2105+ DESC 'MANDATORY: OpenSSH Public key'
2106+ EQUALITY octetStringMatch
2107+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
2108+
2109+# printableString SYNTAX yes|no
2110+objectclass ( 1.3.6.1.4.1.24552.500.1.1.2.0 NAME 'ldapPublicKey' SUP top AUXILIARY
2111+ DESC 'MANDATORY: OpenSSH LPK objectclass'
2112+ MUST ( sshPublicKey $ uid )
2113+ )
7ae7664a
AM		 2114diff -urNp -x '*.orig' openssh-8.4p1.org/openssh-lpk-sun.schema openssh-8.4p1/openssh-lpk-sun.schema
2115--- openssh-8.4p1.org/openssh-lpk-sun.schema 1970-01-01 01:00:00.000000000 +0100
2116+++ openssh-8.4p1/openssh-lpk-sun.schema 2021-03-01 11:29:31.284290176 +0100
501aed94
AM		 2117@@ -0,0 +1,23 @@
2118+#
2119+# LDAP Public Key Patch schema for use with openssh-ldappubkey
2120+# useful with PKA-LDAP also
2121+#
2122+# Author: Eric AUGE <eau@phear.org>
2123+#
2124+# Schema for Sun Directory Server.
2125+# Based on the original schema, modified by Stefan Fischer.
2126+#
2127+
2128+dn: cn=schema
2129+
2130+# octetString SYNTAX
2131+attributeTypes: ( 1.3.6.1.4.1.24552.500.1.1.1.13 NAME 'sshPublicKey'
2132+ DESC 'MANDATORY: OpenSSH Public key'
2133+ EQUALITY octetStringMatch
2134+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
2135+
2136+# printableString SYNTAX yes|no
2137+objectClasses: ( 1.3.6.1.4.1.24552.500.1.1.2.0 NAME 'ldapPublicKey' SUP top AUXILIARY
2138+ DESC 'MANDATORY: OpenSSH LPK objectclass'
2139+ MUST ( sshPublicKey $ uid )
2140+ )
7ae7664a
AM		 2141diff -urNp -x '*.orig' openssh-8.4p1.org/ssh-ldap-helper.8 openssh-8.4p1/ssh-ldap-helper.8
2142--- openssh-8.4p1.org/ssh-ldap-helper.8 1970-01-01 01:00:00.000000000 +0100
2143+++ openssh-8.4p1/ssh-ldap-helper.8 2021-03-01 11:29:31.284290176 +0100
2144@@ -0,0 +1,79 @@
2145+.\" $OpenBSD: ssh-ldap-helper.8,v 1.1 2010/02/10 23:20:38 markus Exp $
2146+.\"
2147+.\" Copyright (c) 2010 Jan F. Chadima. All rights reserved.
2148+.\"
2149+.\" Permission to use, copy, modify, and distribute this software for any
2150+.\" purpose with or without fee is hereby granted, provided that the above
2151+.\" copyright notice and this permission notice appear in all copies.
2152+.\"
2153+.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
2154+.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
2155+.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
2156+.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
2157+.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
2158+.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
2159+.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
2160+.\"
2161+.Dd $Mdocdate: April 29 2010 $
2162+.Dt SSH-LDAP-HELPER 8
2163+.Os
2164+.Sh NAME
2165+.Nm ssh-ldap-helper
2166+.Nd sshd helper program for ldap support
2167+.Sh SYNOPSIS
2168+.Nm ssh-ldap-helper
2169+.Op Fl devw
2170+.Op Fl f Ar file
2171+.Op Fl s Ar user
2172+.Sh DESCRIPTION
2173+.Nm
2174+is used by
2175+.Xr sshd 1
2176+to access keys provided by an LDAP.
2177+.Nm
2178+is disabled by default and can only be enabled in the
2179+sshd configuration file
2180+.Pa /etc/ssh/sshd_config
2181+by setting
2182+.Cm AuthorizedKeysCommand
2183+to
2184+.Dq /usr/libexec/ssh-ldap-wrapper .
2185+.Pp
2186+.Nm
2187+is not intended to be invoked by the user, but from
2188+.Xr sshd 8 via
2189+.Xr ssh-ldap-wrapper .
2190+.Pp
2191+The options are as follows:
2192+.Bl -tag -width Ds
2193+.It Fl d
2194+Set the debug mode;
2195+.Nm
2196+prints all logs to stderr instead of syslog.
2197+.It Fl e
2198+Implies \-w;
2199+.Nm
2200+halts if it encounters an unknown item in the ldap.conf file.
2201+.It Fl f
2202+.Nm
2203+uses this file as the ldap configuration file instead of /etc/ssh/ldap.conf (default).
2204+.It Fl s
2205+.Nm
2206+prints out the user's keys to stdout and exits.
2207+.It Fl v
2208+Implies \-d;
2209+increases verbosity.
2210+.It Fl w
2211+.Nm
2212+writes warnings about unknown items in the ldap.conf configuration file.
2213+.El
2214+.Sh SEE ALSO
2215+.Xr sshd 8 ,
2216+.Xr sshd_config 5 ,
2217+.Xr ssh-ldap.conf 5 ,
2218+.Sh HISTORY
2219+.Nm
2220+first appeared in
2221+OpenSSH 5.5 + PKA-LDAP .
2222+.Sh AUTHORS
2223+.An Jan F. Chadima Aq jchadima@redhat.com
2224diff -urNp -x '*.orig' openssh-8.4p1.org/ssh-ldap-wrapper openssh-8.4p1/ssh-ldap-wrapper
2225--- openssh-8.4p1.org/ssh-ldap-wrapper 1970-01-01 01:00:00.000000000 +0100
2226+++ openssh-8.4p1/ssh-ldap-wrapper 2021-03-01 11:29:31.284290176 +0100
2227@@ -0,0 +1,4 @@
2228+#!/bin/sh
2229+
2230+exec /usr/libexec/openssh/ssh-ldap-helper -s "$1"
2231+
2232diff -urNp -x '*.orig' openssh-8.4p1.org/ssh-ldap.conf.5 openssh-8.4p1/ssh-ldap.conf.5
2233--- openssh-8.4p1.org/ssh-ldap.conf.5 1970-01-01 01:00:00.000000000 +0100
2234+++ openssh-8.4p1/ssh-ldap.conf.5 2021-03-01 11:29:31.284290176 +0100
3eddefd2 2235@@ -0,0 +1,379 @@
501aed94
AM		 2236+.\" $OpenBSD: ssh-ldap.conf.5,v 1.1 2010/02/10 23:20:38 markus Exp $
2237+.\"
2238+.\" Copyright (c) 2010 Jan F. Chadima. All rights reserved.
2239+.\"
2240+.\" Permission to use, copy, modify, and distribute this software for any
2241+.\" purpose with or without fee is hereby granted, provided that the above
2242+.\" copyright notice and this permission notice appear in all copies.
2243+.\"
2244+.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
2245+.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
2246+.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
2247+.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
2248+.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
2249+.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
2250+.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
2251+.\"
2252+.Dd $Mdocdate: may 12 2010 $
2253+.Dt SSH-LDAP.CONF 5
2254+.Os
2255+.Sh NAME
2256+.Nm ssh-ldap.conf
2257+.Nd configuration file for ssh-ldap-helper
2258+.Sh SYNOPSIS
2259+.Nm /etc/ssh/ldap.conf
2260+.Sh DESCRIPTION
2261+.Xr ssh-ldap-helper 8
2262+reads configuration data from
2263+.Pa /etc/ssh/ldap.conf
2264+(or the file specified with
2265+.Fl f
2266+on the command line).
2267+The file contains keyword-argument pairs, one per line.
2268+Lines starting with
2269+.Ql #
2270+and empty lines are interpreted as comments.
2271+.Pp
2272+The value starts with the first non-blank character after
2273+the keyword's name, and terminates at the end of the line,
2274+or at the last sequence of blanks before the end of the line.
2275+Quoting values that contain blanks
2276+may be incorrect, as the quotes would become part of the value.
2277+The possible keywords and their meanings are as follows (note that
2278+keywords are case-insensitive, and arguments, on a case by case basis, may be case-sensitive).
2279+.Bl -tag -width Ds
2280+.It Cm URI
2281+The argument(s) are in the form
2282+.Pa ldap[si]://[name[:port]]
2283+and specify the URI(s) of an LDAP server(s) to which the
2284+.Xr ssh-ldap-helper 8
2285+should connect. The URI scheme may be any of
2286+.Dq ldap ,
2287+.Dq ldaps
2288+or
2289+.Dq ldapi ,
2290+which refer to LDAP over TCP, LDAP over SSL (TLS) and LDAP
2291+over IPC (UNIX domain sockets), respectively.
2292+Each server's name can be specified as a
2293+domain-style name or an IP address literal. Optionally, the
2294+server's name can followed by a ':' and the port number the LDAP
2295+server is listening on. If no port number is provided, the default
2296+port for the scheme is used (389 for ldap://, 636 for ldaps://).
2297+For LDAP over IPC, name is the name of the socket, and no port
2298+is required, nor allowed; note that directory separators must be
2299+URL-encoded, like any other characters that are special to URLs;
2300+A space separated list of URIs may be provided.
2301+There is no default.
2302+.It Cm Base
2303+Specifies the default base Distinguished Name (DN) to use when performing ldap operations.
2304+The base must be specified as a DN in LDAP format.
2305+There is no default.
2306+.It Cm BindDN
2307+Specifies the default BIND DN to use when connecting to the ldap server.
2308+The bind DN must be specified as a Distinguished Name in LDAP format.
2309+There is no default.
2310+.It Cm BindPW
2311+Specifies the default password to use when connecting to the ldap server via
2312+.Cm BindDN .
2313+There is no default.
2314+.It Cm RootBindDN
2315+Intentionaly does nothing. Recognized for compatibility reasons.
2316+.It Cm Host
2317+The argument(s) specifies the name(s) of an LDAP server(s) to which the
2318+.Xr ssh-ldap-helper 8
2319+should connect. Each server's name can be specified as a
2320+domain-style name or an IP address and optionally followed by a ':' and
2321+the port number the ldap server is listening on. A space-separated
2322+list of hosts may be provided.
2323+There is no default.
2324+.Cm Host
2325+is deprecated in favor of
2326+.Cm URI .
2327+.It Cm Port
2328+Specifies the default port used when connecting to LDAP servers(s).
2329+The port may be specified as a number.
2330+The default port is 389 for ldap:// or 636 for ldaps:// respectively.
2331+.Cm Port
2332+is deprecated in favor of
2333+.Cm URI .
2334+.It Cm Scope
2335+Specifies the starting point of an LDAP search and the depth from the base DN to which the search should descend.
2336+There are three options (values) that can be assigned to the
2337+.Cm Scope parameter:
2338+.Dq base ,
2339+.Dq one
2340+and
2341+.Dq subtree .
2342+Alias for the subtree is
2343+.Dq sub .
2344+The value
2345+.Dq base
2346+is used to indicate searching only the entry at the base DN, resulting in only that entry being returned (keeping in mind that it also has to meet the search filter criteria!).
2347+The value
2348+.Dq one
2349+is used to indicate searching all entries one level under the base DN, but not including the base DN and not including any entries under that one level under the base DN.
2350+The value
2351+.Dq subtree
2352+is used to indicate searching of all entries at all levels under and including the specified base DN.
2353+The default is
2354+.Dq subtree .
2355+.It Cm Deref
2356+Specifies how alias dereferencing is done when performing a search. There are four
2357+possible values that can be assigned to the
2358+.Cm Deref
2359+parameter:
2360+.Dq never ,
2361+.Dq searching ,
2362+.Dq finding ,
2363+and
2364+.Dq always .
2365+The value
2366+.Dq never
2367+means that the aliases are never dereferenced.
2368+The value
2369+.Dq searching
2370+means that the aliases are dereferenced in subordinates of the base object, but
2371+not in locating the base object of the search.
2372+The value
2373+.Dq finding
2374+means that the aliases are only dereferenced when locating the base object of the search.
2375+The value
2376+.Dq always
2377+means that the aliases are dereferenced both in searching and in locating the base object
2378+of the search.
2379+The default is
2380+.Dq never .
2381+.It Cm TimeLimit
2382+Specifies a time limit (in seconds) to use when performing searches.
2383+The number should be a non-negative integer. A
2384+.Cm TimeLimit
2385+of zero (0) specifies that the search time is unlimited. Please note that the server
2386+may still apply any server-side limit on the duration of a search operation.
2387+The default value is 10.
2388+.It Cm TimeOut
2389+Is an aliast to
2390+.Cm TimeLimit .
2391+.It Cm Bind_TimeLimit
2392+Specifies the timeout (in seconds) after which the poll(2)/select(2)
2393+following a connect(2) returns in case of no activity.
2394+The default value is 10.
2395+.It Cm Network_TimeOut
2396+Is an alias to
2397+.Cm Bind_TimeLimit .
2398+.It Cm Ldap_Version
2399+Specifies what version of the LDAP protocol should be used.
2400+The allowed values are 2 or 3. The default is 3.
2401+.It Cm Version
2402+Is an alias to
2403+.Cm Ldap_Version .
2404+.It Cm Bind_Policy
2405+Specifies the policy to use for reconnecting to an unavailable LDAP server. There are 2 available values:
2406+.Dq hard
2407+and
2408+.Dq soft.
2409+.Dq hard has 2 aliases
2410+.Dq hard_open
2411+and
2412+.Dq hard_init .
2413+The value
2414+.Dq hard
2415+means that reconects that the
2416+.Xr ssh-ldap-helper 8
2417+tries to reconnect to the LDAP server 5 times before failure. There is exponential backoff before retrying.
2418+The value
2419+.Dq soft
2420+means that
2421+.Xr ssh-ldap-helper 8
2422+fails immediately when it cannot connect to the LDAP seerver.
2423+The deault is
2424+.Dq hard .
2425+.It Cm SSLPath
2426+Specifies the path to the X.509 certificate database.
2427+There is no default.
2428+.It Cm SSL
2429+Specifies whether to use SSL/TLS or not.
2430+There are three allowed values:
2431+.Dq yes ,
2432+.Dq no
2433+and
2434+.Dq start_tls
2435+Both
2436+.Dq true
2437+and
2438+.Dq on
2439+are the aliases for
2440+.Dq yes .
2441+.Dq false
2442+and
2443+.Dq off
2444+are the aliases for
2445+.Dq no .
2446+If
2447+.Dq start_tls
2448+is specified then StartTLS is used rather than raw LDAP over SSL.
2449+The default for ldap:// is
2450+.Dq start_tls ,
2451+for ldaps://
2452+.Dq yes
2453+and
2454+.Dq no
2455+for the ldapi:// .
2456+In case of host based configuration the default is
2457+.Dq start_tls .
2458+.It Cm Referrals
2459+Specifies if the client should automatically follow referrals returned
2460+by LDAP servers.
2461+The value can be or
2462+.Dq yes
2463+or
2464+.Dq no .
2465+.Dq true
2466+and
2467+.Dq on
2468+are the aliases for
2469+.Dq yes .
2470+.Dq false
2471+and
2472+.Dq off
2473+are the aliases for
2474+.Dq no .
2475+The default is yes.
2476+.It Cm Restart
2477+Specifies whether the LDAP client library should restart the select(2) system call when interrupted.
2478+The value can be or
2479+.Dq yes
2480+or
2481+.Dq no .
2482+.Dq true
2483+and
2484+.Dq on
2485+are the aliases for
2486+.Dq yes .
2487+.Dq false
2488+and
2489+.Dq off
2490+are the aliases for
2491+.Dq no .
2492+The default is yes.
2493+.It Cm TLS_CheckPeer
2494+Specifies what checks to perform on server certificates in a TLS session,
2495+if any. The value
2496+can be specified as one of the following keywords:
2497+.Dq never ,
2498+.Dq hard ,
2499+.Dq demand ,
2500+.Dq allow
2501+and
2502+.Dq try .
2503+.Dq true ,
2504+.Dq on
2505+and
2506+.Dq yes
2507+are aliases for
2508+.Dq hard .
2509+.Dq false ,
2510+.Dq off
2511+and
2512+.Dq no
2513+are the aliases for
2514+.Dq never .
2515+The value
2516+.Dq never
2517+means that the client will not request or check any server certificate.
2518+The value
2519+.Dq allow
2520+means that the server certificate is requested. If no certificate is provided,
2521+the session proceeds normally. If a bad certificate is provided, it will
2522+be ignored and the session proceeds normally.
2523+The value
2524+.Dq try
2525+means that the server certificate is requested. If no certificate is provided,
2526+the session proceeds normally. If a bad certificate is provided,
2527+the session is immediately terminated.
2528+The value
2529+.Dq demand
2530+means that the server certificate is requested. If no
2531+certificate is provided, or a bad certificate is provided, the session
2532+is immediately terminated.
2533+The value
2534+.Dq hard
2535+is the same as
2536+.Dq demand .
2537+It requires an SSL connection. In the case of the plain conection the
2538+session is immediately terminated.
2539+The default is
2540+.Dq hard .
2541+.It Cm TLS_ReqCert
2542+Is an alias for
2543+.Cm TLS_CheckPeer .
2544+.It Cm TLS_CACertFile
2545+Specifies the file that contains certificates for all of the Certificate
2546+Authorities the client will recognize.
2547+There is no default.
2548+.It Cm TLS_CACert
2549+Is an alias for
2550+.Cm TLS_CACertFile .
2551+.It Cm TLS_CACertDIR
2552+Specifies the path of a directory that contains Certificate Authority
2553+certificates in separate individual files. The
2554+.Cm TLS_CACert
2555+is always used before
2556+.Cm TLS_CACertDir .
2557+The specified directory must be managed with the OpenSSL c_rehash utility.
2558+There is no default.
2559+.It Cm TLS_Ciphers
2560+Specifies acceptable cipher suite and preference order.
2561+The value should be a cipher specification for OpenSSL,
2562+e.g.,
2563+.Dq HIGH:MEDIUM:+SSLv2 .
2564+The default is
2565+.Dq ALL .
2566+.It Cm TLS_Cipher_Suite
2567+Is an alias for
2568+.Cm TLS_Ciphers .
2569+.It Cm TLS_Cert
2570+Specifies the file that contains the client certificate.
2571+There is no default.
2572+.It Cm TLS_Certificate
2573+Is an alias for
2574+.Cm TLS_Cert .
2575+.It Cm TLS_Key
2576+Specifies the file that contains the private key that matches the certificate
2577+stored in the
2578+.Cm TLS_Cert
2579+file. Currently, the private key must not be protected with a password, so
2580+it is of critical importance that the key file is protected carefully.
2581+There is no default.
2582+.It Cm TLS_RandFile
2583+Specifies the file to obtain random bits from when /dev/[u]random is
2584+not available. Generally set to the name of the EGD/PRNGD socket.
2585+The environment variable RANDFILE can also be used to specify the filename.
2586+There is no default.
2587+.It Cm LogDir
2588+Specifies the directory used for logging by the LDAP client library.
2589+There is no default.
2590+.It Cm Debug
2591+Specifies the debug level used for logging by the LDAP client library.
2592+There is no default.
2593+.It Cm SSH_Filter
2594+Specifies the user filter applied on the LDAP serch.
2595+The default is no filter.
3eddefd2
ER		 2596+.It Cm AccountClass
2597+Specifies the LDAP class used to find user accounts.
2598+The default is posixAccount.
501aed94
AM		 2599+.El
2600+.Sh FILES
2601+.Bl -tag -width Ds
2602+.It Pa /etc/ssh/ldap.conf
2603+Ldap configuration file for
2604+.Xr ssh-ldap-helper 8 .
2605+.El
2606+.Sh "SEE ALSO"
2607+.Xr ldap.conf 5 ,
2608+.Xr ssh-ldap-helper 8
2609+.Sh HISTORY
2610+.Nm
2611+first appeared in
2612+OpenSSH 5.5 + PKA-LDAP .
2613+.Sh AUTHORS
2614+.An Jan F. Chadima Aq jchadima@redhat.com
OpenSSH free Secure Shell (SSH) implementation
This page took 6.978769 seconds and 4 git commands to generate.