]> git.pld-linux.org Git - packages/openssh.git/blame - openssh-5.9p1-ldap.patch
projects / packages / openssh.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
- fix ssh-ldap-helper path
[packages/openssh.git] / openssh-5.9p1-ldap.patch
CommitLineData
501aed94
AM		 1diff -up openssh-5.9p0/HOWTO.ldap-keys.ldap openssh-5.9p0/HOWTO.ldap-keys
2--- openssh-5.9p0/HOWTO.ldap-keys.ldap 2011-08-30 15:57:12.449212853 +0200
3+++ openssh-5.9p0/HOWTO.ldap-keys 2011-08-30 15:57:12.453101662 +0200
4@@ -0,0 +1,108 @@
5+
6+HOW TO START
7+
8+1) configure LDAP server
9+ * Use LDAP server documentation
10+2) add appropriate LDAP schema
11+ * For OpenLDAP or SunONE Use attached schema, otherwise you have to create it.
12+ * LDAP user entry
13+ User entry:
14+ - attached to the 'ldapPublicKey' objectclass
15+ - attached to the 'posixAccount' objectclass
16+ - with a filled 'sshPublicKey' attribute
17+3) insert users into LDAP
18+ * Use LDAP Tree management tool as useful
19+ * Entry in the LDAP server must respect 'posixAccount' and 'ldapPublicKey' which are defined in core.schema and the additionnal lpk.schema.
20+ * Example:
21+ dn: uid=captain,ou=commanders,dc=enterprise,dc=universe
22+ objectclass: top
23+ objectclass: person
24+ objectclass: organizationalPerson
25+ objectclass: posixAccount
26+ objectclass: ldapPublicKey
27+ description: Jonathan Archer
28+ userPassword: Porthos
29+ cn: onathan Archer
30+ sn: onathan Archer
31+ uid: captain
32+ uidNumber: 1001
33+ gidNumber: 1001
34+ homeDirectory: /home/captain
35+ sshPublicKey: ssh-rss AAAAB3.... =captain@universe
36+ sshPublicKey: command="kill -9 1" ssh-rss AAAAM5...
37+4) on the ssh side set in sshd_config
38+ * Set up the backend
39+ AuthorizedKeysCommand "/usr/libexec/openssh/ssh-ldap-wrapper"
40+ AuthorizedKeysCommandRunAs <appropriate user to run LDAP>
41+ * Do not forget to set
42+ PubkeyAuthentication yes
43+ * Swith off unnecessary auth methods
44+5) confugure ldap.conf
45+ * Default ldap.conf is placed in /etc/ssh
46+ * The configuration style is the same as other ldap based aplications
47+6) if necessary edit ssh-ldap-wrapper
48+ * There is a possibility to change ldap.conf location
49+ * There are some debug options
50+ * Example
51+ /usr/libexec/openssh -s -f /etc/ldap.conf -w -d >> /tmp/ldapdebuglog.txt
52+
53+HOW TO MIGRATE FROM LPK
54+
55+1) goto HOW TO START 4) .... the ldap schema is the same
56+
57+2) convert the group requests to the appropriate LDAP requests
58+
59+HOW TO SOLVE PROBLEMS
60+
61+1) use debug in sshd
62+ * /usr/sbin/sshd -d -d -d -d
63+2) use debug in ssh-ldap-helper
64+ * ssh-ldap-helper -d -d -d -d -s <username>
65+3) use tcpdump ... other ldap client etc.
66+
67+ADVANTAGES
68+
69+1) Blocking an user account can be done directly from LDAP (if sshd is using PubkeyAuthentication + AuthorizedKeysCommand with ldap only).
70+
71+DISADVANTAGES
72+
73+1) LDAP must be well configured, getting the public key of some user is not a problem, but if anonymous LDAP
74+ allows write to users dn, somebody could replace some user's public key by his own and impersonate some
75+ of your users in all your server farm -- be VERY CAREFUL.
76+2) With incomplete PKI the MITM attack when sshd is requesting the public key, could lead to a compromise of your servers allowing login
77+ as the impersonated user.
78+3) If LDAP server is down there may be no fallback on passwd auth.
79+
80+MISC.
81+
82+1) todo
83+ * Possibility to reuse the ssh-ldap-helper.
84+ * Tune the LDAP part to accept all possible LDAP configurations.
85+
86+2) differences from original lpk
87+ * No LDAP code in sshd.
88+ * Support for various LDAP platforms and configurations.
89+ * LDAP is configured in separate ldap.conf file.
90+
91+3) docs/link
92+ * http://pacsec.jp/core05/psj05-barisani-en.pdf
93+ * http://fritz.potsdam.edu/projects/openssh-lpk/
94+ * http://fritz.potsdam.edu/projects/sshgate/
95+ * http://dev.inversepath.com/trac/openssh-lpk
96+ * http://lam.sf.net/ ( http://lam.sourceforge.net/documentation/supportedSchemas.htm )
97+
98+4) contributors/ideas/greets
99+ - Eric AUGE <eau@phear.org>
100+ - Andrea Barisani <andrea@inversepath.com>
101+ - Falk Siemonsmeier.
102+ - Jacob Rief.
103+ - Michael Durchgraf.
104+ - frederic peters.
105+ - Finlay dobbie.
106+ - Stefan Fisher.
107+ - Robin H. Johnson.
108+ - Adrian Bridgett.
109+
110+5) Author
111+ Jan F. Chadima <jchadima@redhat.com>
112+
113diff -up openssh-5.9p0/Makefile.in.ldap openssh-5.9p0/Makefile.in
114--- openssh-5.9p0/Makefile.in.ldap 2011-08-30 15:57:01.693024742 +0200
115+++ openssh-5.9p0/Makefile.in 2011-08-30 16:00:02.478212295 +0200
116@@ -25,6 +25,8 @@ SSH_PROGRAM=@bindir@/ssh
117 ASKPASS_PROGRAM=$(libexecdir)/ssh-askpass
118 SFTP_SERVER=$(libexecdir)/sftp-server
119 SSH_KEYSIGN=$(libexecdir)/ssh-keysign
120+SSH_LDAP_HELPER=$(libexecdir)/ssh-ldap-helper
121+SSH_LDAP_WRAPPER=$(libexecdir)/ssh-ldap-wrapper
122 SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
123 PRIVSEP_PATH=@PRIVSEP_PATH@
124 SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
125@@ -58,8 +60,9 @@ XAUTH_PATH=@XAUTH_PATH@
126 LDFLAGS=-L. -Lopenbsd-compat/ @LDFLAGS@
127 EXEEXT=@EXEEXT@
128 MANFMT=@MANFMT@
129+INSTALL_SSH_LDAP_HELPER=@INSTALL_SSH_LDAP_HELPER@
130
131-TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT)
132+TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT)
133
134 LIBSSH_OBJS=acss.o authfd.o authfile.o bufaux.o bufbn.o buffer.o \
135 canohost.o channels.o cipher.o cipher-acss.o cipher-aes.o \
136@@ -92,8 +95,8 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passw
137 roaming_common.o roaming_serv.o \
138 sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o
139
140-MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out sshd_config.5.out ssh_config.5.out
141-MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 sshd_config.5 ssh_config.5
142+MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out ssh-ldap-helper.8.out sshd_config.5.out ssh_config.5.out ssh-ldap.conf.5.out
143+MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 ssh-ldap-helper.8 sshd_config.5 ssh_config.5 ssh-ldap.conf.5
144 MANTYPE = @MANTYPE@
145
146 CONFIGFILES=sshd_config.out ssh_config.out moduli.out
147@@ -161,6 +164,9 @@ ssh-keysign$(EXEEXT): $(LIBCOMPAT) libss
148 ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-pkcs11-helper.o ssh-pkcs11.o
149 $(LD) -o $@ ssh-pkcs11-helper.o ssh-pkcs11.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
150
151+ssh-ldap-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o
152+ $(LD) -o $@ ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)
153+
154 ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o roaming_dummy.o
155 $(LD) -o $@ ssh-keyscan.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
156
157@@ -256,6 +262,10 @@ install-files:
158 $(INSTALL) -m 0755 $(STRIP_OPT) sshd$(EXEEXT) $(DESTDIR)$(sbindir)/sshd$(EXEEXT)
159 $(INSTALL) -m 4711 $(STRIP_OPT) ssh-keysign$(EXEEXT) $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
160 $(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
161+ if test ! -z "$(INSTALL_SSH_LDAP_HELPER)" ; then \
162+ $(INSTALL) -m 0700 $(STRIP_OPT) ssh-ldap-helper $(DESTDIR)$(SSH_LDAP_HELPER) ; \
163+ $(INSTALL) -m 0700 ssh-ldap-wrapper $(DESTDIR)$(SSH_LDAP_WRAPPER) ; \
164+ fi
165 $(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
166 $(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
167 $(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
168@@ -272,6 +282,10 @@ install-files:
169 $(INSTALL) -m 644 sftp-server.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
170 $(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
171 $(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
172+ if test ! -z "$(INSTALL_SSH_LDAP_HELPER)" ; then \
173+ $(INSTALL) -m 644 ssh-ldap-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-ldap-helper.8 ; \
174+ $(INSTALL) -m 644 ssh-ldap.conf.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/ssh-ldap.conf.5 ; \
175+ fi
176 -rm -f $(DESTDIR)$(bindir)/slogin
177 ln -s ./ssh$(EXEEXT) $(DESTDIR)$(bindir)/slogin
178 -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1
179@@ -301,6 +315,13 @@ install-sysconf:
180 else \
181 echo "$(DESTDIR)$(sysconfdir)/moduli already exists, install will not overwrite"; \
182 fi
183+ if test ! -z "$(INSTALL_SSH_LDAP_HELPER)" ; then \
184+ if [ ! -f $(DESTDIR)$(sysconfdir)/ldap.conf ]; then \
185+ $(INSTALL) -m 644 ldap.conf $(DESTDIR)$(sysconfdir)/ldap.conf; \
186+ else \
187+ echo "$(DESTDIR)$(sysconfdir)/ldap.conf already exists, install will not overwrite"; \
188+ fi ; \
189+ fi
190
191 host-key: ssh-keygen$(EXEEXT)
192 @if [ -z "$(DESTDIR)" ] ; then \
193@@ -358,6 +379,8 @@ uninstall:
194 -rm -r $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
195 -rm -f $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
196 -rm -f $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
197+ -rm -f $(DESTDIR)$(SSH_LDAP_HELPER)$(EXEEXT)
198+ -rm -f $(DESTDIR)$(SSH_LDAP_WRAPPER)$(EXEEXT)
199 -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
200 -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
201 -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
202@@ -369,6 +392,7 @@ uninstall:
203 -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
204 -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
205 -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
206+ -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-ldap-helper.8
207 -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1
208
209 tests interop-tests: $(TARGETS)
210diff -up openssh-5.9p0/configure.ac.ldap openssh-5.9p0/configure.ac
211--- openssh-5.9p0/configure.ac.ldap 2011-08-30 15:57:11.297032991 +0200
212+++ openssh-5.9p0/configure.ac 2011-08-30 15:57:12.664024959 +0200
213@@ -1433,6 +1433,106 @@ AC_ARG_WITH(authorized-keys-command,
214 ]
215 )
216
217+# Check whether user wants LDAP support
218+LDAP_MSG="no"
219+INSTALL_SSH_LDAP_HELPER=""
220+AC_ARG_WITH(ldap,
221+ [ --with-ldap[[=PATH]] Enable LDAP pubkey support (optionally in PATH)],
222+ [
223+ if test "x$withval" != "xno" ; then
224+
225+ INSTALL_SSH_LDAP_HELPER="yes"
226+ CPPFLAGS="$CPPFLAGS -DLDAP_DEPRECATED"
227+
228+ if test "x$withval" != "xyes" ; then
229+ CPPFLAGS="$CPPFLAGS -I${withval}/include"
230+ LDFLAGS="$LDFLAGS -L${withval}/lib"
231+ fi
232+
233+ AC_DEFINE([WITH_LDAP_PUBKEY], 1, [Enable LDAP pubkey support])
234+ LDAP_MSG="yes"
235+
236+ AC_CHECK_HEADERS(lber.h)
237+ AC_CHECK_HEADERS(ldap.h, , AC_MSG_ERROR(could not locate <ldap.h>))
238+ AC_CHECK_HEADERS(ldap_ssl.h)
239+
240+ AC_ARG_WITH(ldap-lib,
241+ [ --with-ldap-lib=type select ldap library [auto|netscape5|netscape4|netscape3|umich|openldap]])
242+
243+ if test -z "$with_ldap_lib"; then
244+ with_ldap_lib=auto
245+ fi
246+
247+ if test -z "$found_ldap_lib" -a \( $with_ldap_lib = auto -o $with_ldap_lib = umich -o $with_ldap_lib = openldap \); then
248+ AC_CHECK_LIB(lber, main, LIBS="-llber $LIBS" found_ldap_lib=yes)
249+ AC_CHECK_LIB(ldap, main, LIBS="-lldap $LIBS" found_ldap_lib=yes)
250+ fi
251+
252+ if test -z "$found_ldap_lib" -a \( $with_ldap_lib = auto -o $with_ldap_lib = netscape5 \); then
253+ AC_CHECK_LIB(ldap50, main, LIBS="-lldap50 -lssldap50 -lssl3 -lnss3 -lnspr4 -lprldap50 -lplc4 -lplds4 $LIBS" found_ldap_lib=yes)
254+ fi
255+
256+ if test -z "$found_ldap_lib" -a \( $with_ldap_lib = auto -o $with_ldap_lib = netscape4 \); then
257+ AC_CHECK_LIB(ldapssl41, main, LIBS="-lldapssl41 -lplc3 -lplds3 -lnspr3 $LIBS" found_ldap_lib=yes)
258+ if test -z "$found_ldap_lib"; then
259+ AC_CHECK_LIB(ldapssl40, main, LIBS="-lldapssl40 $LIBS" found_ldap_lib=yes)
260+ fi
261+ if test -z "$found_ldap_lib"; then
262+ AC_CHECK_LIB(ldap41, main, LIBS="-lldap41 $LIBS" found_ldap_lib=yes)
263+ fi
264+ if test -z "$found_ldap_lib"; then
265+ AC_CHECK_LIB(ldap40, main, LIBS="-lldap40 $LIBS" found_ldap_lib=yes)
266+ fi
267+ fi
268+
269+ if test -z "$found_ldap_lib" -a \( $with_ldap_lib = auto -o $with_ldap_lib = netscape3 \); then
270+ AC_CHECK_LIB(ldapssl30, main, LIBS="-lldapssl30 $LIBS" found_ldap_lib=yes)
271+ fi
272+
273+ if test -z "$found_ldap_lib"; then
274+ AC_MSG_ERROR(could not locate a valid LDAP library)
275+ fi
276+
277+ AC_MSG_CHECKING([for working LDAP support])
278+ AC_TRY_COMPILE(
279+ [#include <sys/types.h>
280+ #include <ldap.h>],
281+ [(void)ldap_init(0, 0);],
282+ [AC_MSG_RESULT(yes)],
283+ [
284+ AC_MSG_RESULT(no)
285+ AC_MSG_ERROR([** Incomplete or missing ldap libraries **])
286+ ])
287+ AC_CHECK_FUNCS( \
288+ ldap_init \
289+ ldap_get_lderrno \
290+ ldap_set_lderrno \
291+ ldap_parse_result \
292+ ldap_memfree \
293+ ldap_controls_free \
294+ ldap_set_option \
295+ ldap_get_option \
296+ ldapssl_init \
297+ ldap_start_tls_s \
298+ ldap_pvt_tls_set_option \
299+ ldap_initialize \
300+ )
301+ AC_CHECK_FUNCS(ldap_set_rebind_proc,
302+ AC_MSG_CHECKING([number arguments of ldap_set_rebind_proc])
303+ AC_TRY_COMPILE(
304+ [#include <lber.h>
305+ #include <ldap.h>],
306+ [ldap_set_rebind_proc(0, 0, 0);],
307+ [ac_cv_ldap_set_rebind_proc=3],
308+ [ac_cv_ldap_set_rebind_proc=2])
309+ AC_MSG_RESULT($ac_cv_ldap_set_rebind_proc)
310+ AC_DEFINE(LDAP_SET_REBIND_PROC_ARGS, $ac_cv_ldap_set_rebind_proc, [number arguments of ldap_set_rebind_proc])
311+ )
312+ fi
313+ ]
314+)
315+AC_SUBST(INSTALL_SSH_LDAP_HELPER)
316+
317 dnl Checks for library functions. Please keep in alphabetical order
318 AC_CHECK_FUNCS([ \
319 arc4random \
320diff -up openssh-5.9p0/ldap-helper.c.ldap openssh-5.9p0/ldap-helper.c
321--- openssh-5.9p0/ldap-helper.c.ldap 2011-08-30 15:57:12.754025033 +0200
322+++ openssh-5.9p0/ldap-helper.c 2011-08-30 15:57:12.759025510 +0200
323@@ -0,0 +1,155 @@
324+/* $OpenBSD: ssh-pka-ldap.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
325+/*
326+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
327+ *
328+ * Redistribution and use in source and binary forms, with or without
329+ * modification, are permitted provided that the following conditions
330+ * are met:
331+ * 1. Redistributions of source code must retain the above copyright
332+ * notice, this list of conditions and the following disclaimer.
333+ * 2. Redistributions in binary form must reproduce the above copyright
334+ * notice, this list of conditions and the following disclaimer in the
335+ * documentation and/or other materials provided with the distribution.
336+ *
337+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
338+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
339+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
340+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
341+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
342+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
343+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
344+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
345+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
346+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
347+ */
348+
349+#include "ldapincludes.h"
350+#include "log.h"
351+#include "misc.h"
352+#include "xmalloc.h"
353+#include "ldapconf.h"
354+#include "ldapbody.h"
355+#include <string.h>
356+#include <unistd.h>
357+
358+static int config_debug = 0;
359+int config_exclusive_config_file = 0;
360+static char *config_file_name = "/etc/ssh/ldap.conf";
361+static char *config_single_user = NULL;
362+static int config_verbose = SYSLOG_LEVEL_VERBOSE;
363+int config_warning_config_file = 0;
364+extern char *__progname;
365+
366+static void
367+usage(void)
368+{
369+ fprintf(stderr, "usage: %s [options]\n",
370+ __progname);
371+ fprintf(stderr, "Options:\n");
372+ fprintf(stderr, " -d Output the log messages to stderr.\n");
373+ fprintf(stderr, " -e Check the config file for unknown commands.\n");
374+ fprintf(stderr, " -f file Use alternate config file (default is /etc/ssh/ldap.conf).\n");
375+ fprintf(stderr, " -s user Do not demonize, send the user's key to stdout.\n");
376+ fprintf(stderr, " -v Increase verbosity of the debug output (implies -d).\n");
377+ fprintf(stderr, " -w Warn on unknown commands in the config file.\n");
378+ exit(1);
379+}
380+
381+/*
382+ * Main program for the ssh pka ldap agent.
383+ */
384+
385+int
386+main(int ac, char **av)
387+{
388+ int opt;
389+ FILE *outfile = NULL;
390+
391+ __progname = ssh_get_progname(av[0]);
392+
393+ log_init(__progname, SYSLOG_LEVEL_DEBUG3, SYSLOG_FACILITY_AUTH, 0);
394+
395+ /*
396+ * Initialize option structure to indicate that no values have been
397+ * set.
398+ */
399+ initialize_options();
400+
401+ /* Parse command-line arguments. */
402+ while ((opt = getopt(ac, av, "def:s:vw")) != -1) {
403+ switch (opt) {
404+ case 'd':
405+ config_debug = 1;
406+ break;
407+
408+ case 'e':
409+ config_exclusive_config_file = 1;
410+ config_warning_config_file = 1;
411+ break;
412+
413+ case 'f':
414+ config_file_name = optarg;
415+ break;
416+
417+ case 's':
418+ config_single_user = optarg;
419+ outfile = fdopen (dup (fileno (stdout)), "w");
420+ break;
421+
422+ case 'v':
423+ config_debug = 1;
424+ if (config_verbose < SYSLOG_LEVEL_DEBUG3)
425+ config_verbose++;
426+ break;
427+
428+ case 'w':
429+ config_warning_config_file = 1;
430+ break;
431+
432+ case '?':
433+ default:
434+ usage();
435+ break;
436+ }
437+ }
438+
439+ /* Initialize loging */
440+ log_init(__progname, config_verbose, SYSLOG_FACILITY_AUTH, config_debug);
441+
442+ if (ac != optind)
443+ fatal ("illegal extra parameter %s", av[1]);
444+
445+ /* Ensure that fds 0 and 2 are open or directed to /dev/null */
446+ if (config_debug == 0)
447+ sanitise_stdfd();
448+
449+ /* Read config file */
450+ read_config_file(config_file_name);
451+ fill_default_options();
452+ if (config_verbose == SYSLOG_LEVEL_DEBUG3) {
453+ debug3 ("=== Configuration ===");
454+ dump_config();
455+ debug3 ("=== *** ===");
456+ }
457+
458+ ldap_checkconfig();
459+ ldap_do_connect();
460+
461+ if (config_single_user) {
462+ process_user (config_single_user, outfile);
463+ } else {
464+ usage();
465+ fatal ("Not yet implemented");
466+/* TODO
467+ * open unix socket a run the loop on it
468+ */
469+ }
470+
471+ ldap_do_close();
472+ return 0;
473+}
474+
475+/* Ugly hack */
476+void *buffer_get_string(Buffer *b, u_int *l) { return NULL; }
477+void buffer_put_string(Buffer *b, const void *f, u_int l) {}
478+
479diff -up openssh-5.9p0/ldap-helper.h.ldap openssh-5.9p0/ldap-helper.h
480--- openssh-5.9p0/ldap-helper.h.ldap 2011-08-30 15:57:12.835024792 +0200
481+++ openssh-5.9p0/ldap-helper.h 2011-08-30 15:57:12.839024637 +0200
482@@ -0,0 +1,32 @@
483+/* $OpenBSD: ldap-helper.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
484+/*
485+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
486+ *
487+ * Redistribution and use in source and binary forms, with or without
488+ * modification, are permitted provided that the following conditions
489+ * are met:
490+ * 1. Redistributions of source code must retain the above copyright
491+ * notice, this list of conditions and the following disclaimer.
492+ * 2. Redistributions in binary form must reproduce the above copyright
493+ * notice, this list of conditions and the following disclaimer in the
494+ * documentation and/or other materials provided with the distribution.
495+ *
496+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
497+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
498+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
499+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
500+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
501+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
502+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
503+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
504+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
505+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
506+ */
507+
508+#ifndef LDAP_HELPER_H
509+#define LDAP_HELPER_H
510+
511+extern int config_exclusive_config_file;
512+extern int config_warning_config_file;
513+
514+#endif /* LDAP_HELPER_H */
515diff -up openssh-5.9p0/ldap.conf.ldap openssh-5.9p0/ldap.conf
516--- openssh-5.9p0/ldap.conf.ldap 2011-08-30 15:57:12.929026186 +0200
517+++ openssh-5.9p0/ldap.conf 2011-08-30 15:57:12.933024937 +0200
518@@ -0,0 +1,88 @@
519+# $Id$
520+#
521+# This is the example configuration file for the OpenSSH
522+# LDAP backend
523+#
524+# see ssh-ldap.conf(5)
525+#
526+
527+# URI with your LDAP server name. This allows to use
528+# Unix Domain Sockets to connect to a local LDAP Server.
529+#uri ldap://127.0.0.1/
530+#uri ldaps://127.0.0.1/
531+#uri ldapi://%2fvar%2frun%2fldapi_sock/
532+# Note: %2f encodes the '/' used as directory separator
533+
534+# Another way to specify your LDAP server is to provide an
535+# host name and the port of our LDAP server. Host name
536+# must be resolvable without using LDAP.
537+# Multiple hosts may be specified, each separated by a
538+# space. How long nss_ldap takes to failover depends on
539+# whether your LDAP client library supports configurable
540+# network or connect timeouts (see bind_timelimit).
541+#host 127.0.0.1
542+
543+# The port.
544+# Optional: default is 389.
545+#port 389
546+
547+# The distinguished name to bind to the server with.
548+# Optional: default is to bind anonymously.
549+#binddn cn=openssh_keys,dc=example,dc=org
550+
551+# The credentials to bind with.
552+# Optional: default is no credential.
553+#bindpw TopSecret
554+
555+# The distinguished name of the search base.
556+#base dc=example,dc=org
557+
558+# The LDAP version to use (defaults to 3
559+# if supported by client library)
560+#ldap_version 3
561+
562+# The search scope.
563+#scope sub
564+#scope one
565+#scope base
566+
567+# Search timelimit
568+#timelimit 30
569+
570+# Bind/connect timelimit
571+#bind_timelimit 30
572+
573+# Reconnect policy: hard (default) will retry connecting to
574+# the software with exponential backoff, soft will fail
575+# immediately.
576+#bind_policy hard
577+
578+# SSL setup, may be implied by URI also.
579+#ssl no
580+#ssl on
581+#ssl start_tls
582+
583+# OpenLDAP SSL options
584+# Require and verify server certificate (yes/no)
585+# Default is to use libldap's default behavior, which can be configured in
586+# /etc/openldap/ldap.conf using the TLS_REQCERT setting. The default for
587+# OpenLDAP 2.0 and earlier is "no", for 2.1 and later is "yes".
588+#tls_checkpeer hard
589+
590+# CA certificates for server certificate verification
591+# At least one of these are required if tls_checkpeer is "yes"
592+#tls_cacertfile /etc/ssl/ca.cert
593+#tls_cacertdir /etc/pki/tls/certs
594+
595+# Seed the PRNG if /dev/urandom is not provided
596+#tls_randfile /var/run/egd-pool
597+
598+# SSL cipher suite
599+# See man ciphers for syntax
600+#tls_ciphers TLSv1
601+
602+# Client certificate and key
603+# Use these, if your server requires client authentication.
604+#tls_cert
605+#tls_key
606+
607diff -up openssh-5.9p0/ldapbody.c.ldap openssh-5.9p0/ldapbody.c
608--- openssh-5.9p0/ldapbody.c.ldap 2011-08-30 15:57:13.005024661 +0200
609+++ openssh-5.9p0/ldapbody.c 2011-08-30 15:57:13.011024848 +0200
610@@ -0,0 +1,494 @@
611+/* $OpenBSD: ldapbody.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
612+/*
613+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
614+ *
615+ * Redistribution and use in source and binary forms, with or without
616+ * modification, are permitted provided that the following conditions
617+ * are met:
618+ * 1. Redistributions of source code must retain the above copyright
619+ * notice, this list of conditions and the following disclaimer.
620+ * 2. Redistributions in binary form must reproduce the above copyright
621+ * notice, this list of conditions and the following disclaimer in the
622+ * documentation and/or other materials provided with the distribution.
623+ *
624+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
625+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
626+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
627+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
628+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
629+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
630+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
631+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
632+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
633+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
634+ */
635+
636+#include "ldapincludes.h"
637+#include "log.h"
638+#include "xmalloc.h"
639+#include "ldapconf.h"
640+#include "ldapmisc.h"
641+#include "ldapbody.h"
642+#include <stdio.h>
643+#include <unistd.h>
644+
645+#define LDAPSEARCH_FORMAT "(&(objectclass=posixAccount)(objectclass=ldapPublicKey)(uid=%s)%s)"
646+#define PUBKEYATTR "sshPublicKey"
647+#define LDAP_LOGFILE "%s/ldap.%d"
648+
649+static FILE *logfile = NULL;
650+static LDAP *ld;
651+
652+static char *attrs[] = {
653+ PUBKEYATTR,
654+ NULL
655+};
656+
657+void
658+ldap_checkconfig (void)
659+{
660+#ifdef HAVE_LDAP_INITIALIZE
661+ if (options.host == NULL && options.uri == NULL)
662+#else
663+ if (options.host == NULL)
664+#endif
665+ fatal ("missing \"host\" in config file");
666+}
667+
668+#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)
669+static int
670+_rebind_proc (LDAP * ld, LDAP_CONST char *url, int request, ber_int_t msgid)
671+{
672+ struct timeval timeout;
673+ int rc;
674+#if defined(HAVE_LDAP_PARSE_RESULT) && defined(HAVE_LDAP_CONTROLS_FREE)
675+ LDAPMessage *result;
676+#endif /* HAVE_LDAP_PARSE_RESULT && HAVE_LDAP_CONTROLS_FREE */
677+
678+ debug2 ("Doing LDAP rebind to %s", options.binddn);
679+ if (options.ssl == SSL_START_TLS) {
680+ if ((rc = ldap_start_tls_s (ld, NULL, NULL)) != LDAP_SUCCESS) {
681+ error ("ldap_starttls_s: %s", ldap_err2string (rc));
682+ return LDAP_OPERATIONS_ERROR;
683+ }
684+ }
685+
686+#if !defined(HAVE_LDAP_PARSE_RESULT) || !defined(HAVE_LDAP_CONTROLS_FREE)
687+ return ldap_simple_bind_s (ld, options.binddn, options.bindpw);
688+#else
689+ if (ldap_simple_bind(ld, options.binddn, options.bindpw) < 0)
690+ fatal ("ldap_simple_bind %s", ldap_err2string (ldap_get_lderrno (ld, 0, 0)));
691+
692+ timeout.tv_sec = options.bind_timelimit;
693+ timeout.tv_usec = 0;
694+ result = NULL;
695+ if ((rc = ldap_result (ld, msgid, FALSE, &timeout, &result)) < 1) {
696+ error ("ldap_result %s", ldap_err2string (ldap_get_lderrno (ld, 0, 0)));
697+ ldap_msgfree (result);
698+ return LDAP_OPERATIONS_ERROR;
699+ }
700+ debug3 ("LDAP rebind to %s succesfull", options.binddn);
701+ return rc;
702+#endif
703+}
704+#else
705+
706+static int
707+_rebind_proc (LDAP * ld, char **whop, char **credp, int *methodp, int freeit)
708+{
709+ if (freeit)
710+ return LDAP_SUCCESS;
711+
712+ *whop = strdup (options.binddn);
713+ *credp = strdup (options.bindpw);
714+ *methodp = LDAP_AUTH_SIMPLE;
715+ debug2 ("Doing LDAP rebind for %s", *whop);
716+ return LDAP_SUCCESS;
717+}
718+#endif
719+
720+void
721+ldap_do_connect(void)
722+{
723+ int rc, msgid, ld_errno = 0;
724+ struct timeval timeout;
725+#if defined(HAVE_LDAP_PARSE_RESULT) && defined(HAVE_LDAP_CONTROLS_FREE)
726+ int parserc;
727+ LDAPMessage *result;
728+ LDAPControl **controls;
729+ int reconnect = 0;
730+#endif /* HAVE_LDAP_PARSE_RESULT && HAVE_LDAP_CONTROLS_FREE */
731+
732+ debug ("LDAP do connect");
733+
734+retry:
735+ if (reconnect) {
736+ debug3 ("Reconnecting with ld_errno %d", ld_errno);
737+ if (options.bind_policy == 0 ||
738+ (ld_errno != LDAP_SERVER_DOWN && ld_errno != LDAP_TIMEOUT) ||
739+ reconnect > 5)
740+ fatal ("Cannot connect to LDAP server");
741+
742+ if (reconnect > 1)
743+ sleep (reconnect - 1);
744+
745+ if (ld != NULL) {
746+ ldap_unbind (ld);
747+ ld = NULL;
748+ }
749+ logit("reconnecting to LDAP server...");
750+ }
751+
752+ if (ld == NULL) {
753+ int rc;
754+ struct timeval tv;
755+
756+#ifdef HAVE_LDAP_SET_OPTION
757+ if (options.debug > 0) {
758+#ifdef LBER_OPT_LOG_PRINT_FILE
759+ if (options.logdir) {
760+ char *logfilename;
761+ int logfilenamelen;
762+
763+ logfilenamelen = strlen (LDAP_LOGFILE) + strlen ("000000") + strlen (options.logdir);
764+ logfilename = xmalloc (logfilenamelen);
765+ snprintf (logfilename, logfilenamelen, LDAP_LOGFILE, options.logdir, (int) getpid ());
766+ logfilename[logfilenamelen - 1] = 0;
767+ if ((logfile = fopen (logfilename, "a")) == NULL)
768+ fatal ("cannot append to %s: %s", logfilename, strerror (errno));
769+ debug3 ("LDAP debug into %s", logfilename);
770+ xfree (logfilename);
771+ ber_set_option (NULL, LBER_OPT_LOG_PRINT_FILE, logfile);
772+ }
773+#endif
774+ if (options.debug) {
775+#ifdef LBER_OPT_DEBUG_LEVEL
776+ ber_set_option (NULL, LBER_OPT_DEBUG_LEVEL, &options.debug);
777+#endif /* LBER_OPT_DEBUG_LEVEL */
778+#ifdef LDAP_OPT_DEBUG_LEVEL
779+ (void) ldap_set_option (NULL, LDAP_OPT_DEBUG_LEVEL, &options.debug);
780+#endif /* LDAP_OPT_DEBUG_LEVEL */
781+ debug3 ("Set LDAP debug to %d", options.debug);
782+ }
783+ }
784+#endif /* HAVE_LDAP_SET_OPTION */
785+
786+ ld = NULL;
787+#ifdef HAVE_LDAPSSL_INIT
788+ if (options.host != NULL) {
789+ if (options.ssl_on == SSL_LDAPS) {
790+ if ((rc = ldapssl_client_init (options.sslpath, NULL)) != LDAP_SUCCESS)
791+ fatal ("ldapssl_client_init %s", ldap_err2string (rc));
792+ debug3 ("LDAPssl client init");
793+ }
794+
795+ if (options.ssl_on != SSL_OFF) {
796+ if ((ld = ldapssl_init (options.host, options.port, TRUE)) == NULL)
797+ fatal ("ldapssl_init failed");
798+ debug3 ("LDAPssl init");
799+ }
800+ }
801+#endif /* HAVE_LDAPSSL_INIT */
802+
803+ /* continue with opening */
804+ if (ld == NULL) {
805+#if defined (HAVE_LDAP_START_TLS_S) || (defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_X_TLS))
806+ /* Some global TLS-specific options need to be set before we create our
807+ * session context, so we set them here. */
808+
809+#ifdef LDAP_OPT_X_TLS_RANDOM_FILE
810+ /* rand file */
811+ if (options.tls_randfile != NULL) {
812+ if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_RANDOM_FILE,
813+ options.tls_randfile)) != LDAP_SUCCESS)
814+ fatal ("ldap_set_option(LDAP_OPT_X_TLS_RANDOM_FILE): %s",
815+ ldap_err2string (rc));
816+ debug3 ("Set TLS random file %s", options.tls_randfile);
817+ }
818+#endif /* LDAP_OPT_X_TLS_RANDOM_FILE */
819+
820+ /* ca cert file */
821+ if (options.tls_cacertfile != NULL) {
822+ if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CACERTFILE,
823+ options.tls_cacertfile)) != LDAP_SUCCESS)
824+ error ("ldap_set_option(LDAP_OPT_X_TLS_CACERTFILE): %s",
825+ ldap_err2string (rc));
826+ debug3 ("Set TLS CA cert file %s ", options.tls_cacertfile);
827+ }
828+
829+ /* ca cert directory */
830+ if (options.tls_cacertdir != NULL) {
831+ if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CACERTDIR,
832+ options.tls_cacertdir)) != LDAP_SUCCESS)
833+ fatal ("ldap_set_option(LDAP_OPT_X_TLS_CACERTDIR): %s",
834+ ldap_err2string (rc));
835+ debug3 ("Set TLS CA cert dir %s ", options.tls_cacertdir);
836+ }
837+
838+ /* require cert? */
839+ if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_REQUIRE_CERT,
840+ &options.tls_checkpeer)) != LDAP_SUCCESS)
841+ fatal ("ldap_set_option(LDAP_OPT_X_TLS_REQUIRE_CERT): %s",
842+ ldap_err2string (rc));
843+ debug3 ("Set TLS check peer to %d ", options.tls_checkpeer);
844+
845+ /* set cipher suite, certificate and private key: */
846+ if (options.tls_ciphers != NULL) {
847+ if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CIPHER_SUITE,
848+ options.tls_ciphers)) != LDAP_SUCCESS)
849+ fatal ("ldap_set_option(LDAP_OPT_X_TLS_CIPHER_SUITE): %s",
850+ ldap_err2string (rc));
851+ debug3 ("Set TLS ciphers to %s ", options.tls_ciphers);
852+ }
853+
854+ /* cert file */
855+ if (options.tls_cert != NULL) {
856+ if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CERTFILE,
857+ options.tls_cert)) != LDAP_SUCCESS)
858+ fatal ("ldap_set_option(LDAP_OPT_X_TLS_CERTFILE): %s",
859+ ldap_err2string (rc));
860+ debug3 ("Set TLS cert file %s ", options.tls_cert);
861+ }
862+
863+ /* key file */
864+ if (options.tls_key != NULL) {
865+ if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_KEYFILE,
866+ options.tls_key)) != LDAP_SUCCESS)
867+ fatal ("ldap_set_option(LDAP_OPT_X_TLS_KEYFILE): %s",
868+ ldap_err2string (rc));
869+ debug3 ("Set TLS key file %s ", options.tls_key);
870+ }
871+#endif
872+#ifdef HAVE_LDAP_INITIALIZE
873+ if (options.uri != NULL) {
874+ if ((rc = ldap_initialize (&ld, options.uri)) != LDAP_SUCCESS)
875+ fatal ("ldap_initialize %s", ldap_err2string (rc));
876+ debug3 ("LDAP initialize %s", options.uri);
877+ }
878+ }
879+#endif /* HAVE_LDAP_INTITIALIZE */
880+
881+ /* continue with opening */
882+ if ((ld == NULL) && (options.host != NULL)) {
883+#ifdef HAVE_LDAP_INIT
884+ if ((ld = ldap_init (options.host, options.port)) == NULL)
885+ fatal ("ldap_init failed");
886+ debug3 ("LDAP init %s:%d", options.host, options.port);
887+#else
888+ if ((ld = ldap_open (options.host, options.port)) == NULL)
889+ fatal ("ldap_open failed");
890+ debug3 ("LDAP open %s:%d", options.host, options.port);
891+#endif /* HAVE_LDAP_INIT */
892+ }
893+
894+ if (ld == NULL)
895+ fatal ("no way to open ldap");
896+
897+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_X_TLS)
898+ if (options.ssl == SSL_LDAPS) {
899+ if ((rc = ldap_set_option (ld, LDAP_OPT_X_TLS, &options.tls_checkpeer)) != LDAP_SUCCESS)
900+ fatal ("ldap_set_option(LDAP_OPT_X_TLS) %s", ldap_err2string (rc));
901+ debug3 ("LDAP set LDAP_OPT_X_TLS_%d", options.tls_checkpeer);
902+ }
903+#endif /* LDAP_OPT_X_TLS */
904+
905+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_PROTOCOL_VERSION)
906+ (void) ldap_set_option (ld, LDAP_OPT_PROTOCOL_VERSION,
907+ &options.ldap_version);
908+#else
909+ ld->ld_version = options.ldap_version;
910+#endif
911+ debug3 ("LDAP set version to %d", options.ldap_version);
912+
913+#if LDAP_SET_REBIND_PROC_ARGS == 3
914+ ldap_set_rebind_proc (ld, _rebind_proc, NULL);
915+#elif LDAP_SET_REBIND_PROC_ARGS == 2
916+ ldap_set_rebind_proc (ld, _rebind_proc);
917+#else
918+#warning unknown LDAP_SET_REBIND_PROC_ARGS
919+#endif
920+ debug3 ("LDAP set rebind proc");
921+
922+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_DEREF)
923+ (void) ldap_set_option (ld, LDAP_OPT_DEREF, &options.deref);
924+#else
925+ ld->ld_deref = options.deref;
926+#endif
927+ debug3 ("LDAP set deref to %d", options.deref);
928+
929+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_TIMELIMIT)
930+ (void) ldap_set_option (ld, LDAP_OPT_TIMELIMIT,
931+ &options.timelimit);
932+#else
933+ ld->ld_timelimit = options.timelimit;
934+#endif
935+ debug3 ("LDAP set timelimit to %d", options.timelimit);
936+
937+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_X_OPT_CONNECT_TIMEOUT)
938+ /*
939+ * This is a new option in the Netscape SDK which sets
940+ * the TCP connect timeout. For want of a better value,
941+ * we use the bind_timelimit to control this.
942+ */
943+ timeout = options.bind_timelimit * 1000;
944+ (void) ldap_set_option (ld, LDAP_X_OPT_CONNECT_TIMEOUT, &timeout);
945+ debug3 ("LDAP set opt connect timeout to %d", timeout);
946+#endif
947+
948+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_NETWORK_TIMEOUT)
949+ tv.tv_sec = options.bind_timelimit;
950+ tv.tv_usec = 0;
951+ (void) ldap_set_option (ld, LDAP_OPT_NETWORK_TIMEOUT, &tv);
952+ debug3 ("LDAP set opt network timeout to %ld.0", tv.tv_sec);
953+#endif
954+
955+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_REFERRALS)
956+ (void) ldap_set_option (ld, LDAP_OPT_REFERRALS,
957+ options.referrals ? LDAP_OPT_ON : LDAP_OPT_OFF);
958+ debug3 ("LDAP set referrals to %d", options.referrals);
959+#endif
960+
961+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_RESTART)
962+ (void) ldap_set_option (ld, LDAP_OPT_RESTART,
963+ options.restart ? LDAP_OPT_ON : LDAP_OPT_OFF);
964+ debug3 ("LDAP set restart to %d", options.restart);
965+#endif
966+
967+#ifdef HAVE_LDAP_START_TLS_S
968+ if (options.ssl == SSL_START_TLS) {
969+ int version;
970+
971+ if (ldap_get_option (ld, LDAP_OPT_PROTOCOL_VERSION, &version)
972+ == LDAP_SUCCESS) {
973+ if (version < LDAP_VERSION3) {
974+ version = LDAP_VERSION3;
975+ (void) ldap_set_option (ld, LDAP_OPT_PROTOCOL_VERSION,
976+ &version);
977+ debug3 ("LDAP set version to %d", version);
978+ }
979+ }
980+
981+ if ((rc = ldap_start_tls_s (ld, NULL, NULL)) != LDAP_SUCCESS)
982+ fatal ("ldap_starttls_s: %s", ldap_err2string (rc));
983+ debug3 ("LDAP start TLS");
984+ }
985+#endif /* HAVE_LDAP_START_TLS_S */
986+ }
987+
988+ if ((msgid = ldap_simple_bind (ld, options.binddn,
989+ options.bindpw)) == -1) {
990+ ld_errno = ldap_get_lderrno (ld, 0, 0);
991+
992+ error ("ldap_simple_bind %s", ldap_err2string (ld_errno));
993+ reconnect++;
994+ goto retry;
995+ }
996+ debug3 ("LDAP simple bind (%s)", options.binddn);
997+
998+ timeout.tv_sec = options.bind_timelimit;
999+ timeout.tv_usec = 0;
1000+ if ((rc = ldap_result (ld, msgid, FALSE, &timeout, &result)) < 1) {
1001+ ld_errno = ldap_get_lderrno (ld, 0, 0);
1002+
1003+ error ("ldap_result %s", ldap_err2string (ld_errno));
1004+ reconnect++;
1005+ goto retry;
1006+ }
1007+ debug3 ("LDAP result in time");
1008+
1009+#if defined(HAVE_LDAP_PARSE_RESULT) && defined(HAVE_LDAP_CONTROLS_FREE)
1010+ controls = NULL;
1011+ if ((parserc = ldap_parse_result (ld, result, &rc, 0, 0, 0, &controls, TRUE)) != LDAP_SUCCESS)
1012+ fatal ("ldap_parse_result %s", ldap_err2string (parserc));
1013+ debug3 ("LDAP parse result OK");
1014+
1015+ if (controls != NULL) {
1016+ ldap_controls_free (controls);
1017+ }
1018+#else
1019+ rc = ldap_result2error (session->ld, result, TRUE);
1020+#endif
1021+ if (rc != LDAP_SUCCESS)
1022+ fatal ("error trying to bind as user \"%s\" (%s)",
1023+ options.binddn, ldap_err2string (rc));
1024+
1025+ debug2 ("LDAP do connect OK");
1026+}
1027+
1028+void
1029+process_user (const char *user, FILE *output)
1030+{
1031+ LDAPMessage *res, *e;
1032+ char *buffer;
1033+ int bufflen, rc, i;
1034+ struct timeval timeout;
1035+
1036+ debug ("LDAP process user");
1037+
1038+ /* quick check for attempts to be evil */
1039+ if ((strchr(user, '(') != NULL) || (strchr(user, ')') != NULL) ||
1040+ (strchr(user, '*') != NULL) || (strchr(user, '\\') != NULL)) {
1041+ logit ("illegal user name %s not processed", user);
1042+ return;
1043+ }
1044+
1045+ /* build filter for LDAP request */
1046+ bufflen = strlen (LDAPSEARCH_FORMAT) + strlen (user);
1047+ if (options.ssh_filter != NULL)
1048+ bufflen += strlen (options.ssh_filter);
1049+ buffer = xmalloc (bufflen);
1050+ snprintf(buffer, bufflen, LDAPSEARCH_FORMAT, user, (options.ssh_filter != NULL) ? options.ssh_filter : NULL);
1051+ buffer[bufflen - 1] = 0;
1052+
1053+ debug3 ("LDAP search scope = %d %s", options.scope, buffer);
1054+
1055+ timeout.tv_sec = options.timelimit;
1056+ timeout.tv_usec = 0;
1057+ if ((rc = ldap_search_st(ld, options.base, options.scope, buffer, attrs, 0, &timeout, &res)) != LDAP_SUCCESS) {
1058+ error ("ldap_search_st(): %s", ldap_err2string (rc));
1059+ xfree (buffer);
1060+ return;
1061+ }
1062+
1063+ /* free */
1064+ xfree (buffer);
1065+
1066+ for (e = ldap_first_entry(ld, res); e != NULL; e = ldap_next_entry(ld, e)) {
1067+ int num;
1068+ struct berval **keys;
1069+
1070+ keys = ldap_get_values_len(ld, e, PUBKEYATTR);
1071+ num = ldap_count_values_len(keys);
1072+ for (i = 0 ; i < num ; i++) {
1073+ char *cp; //, *options = NULL;
1074+
1075+ for (cp = keys[i]->bv_val; *cp == ' ' || *cp == '\t'; cp++);
1076+ if (!*cp || *cp == '\n' || *cp == '#')
1077+ continue;
1078+
1079+ /* We have found the desired key. */
1080+ fprintf (output, "%s\n", keys[i]->bv_val);
1081+ }
1082+
1083+ ldap_value_free_len(keys);
1084+ }
1085+
1086+ ldap_msgfree(res);
1087+ debug2 ("LDAP process user finished");
1088+}
1089+
1090+void
1091+ldap_do_close(void)
1092+{
1093+ int rc;
1094+
1095+ debug ("LDAP do close");
1096+ if ((rc = ldap_unbind_ext(ld, NULL, NULL)) != LDAP_SUCCESS)
1097+ fatal ("ldap_unbind_ext: %s",
1098+ ldap_err2string (rc));
1099+
1100+ ld = NULL;
1101+ debug2 ("LDAP do close OK");
1102+ return;
1103+}
1104+
1105diff -up openssh-5.9p0/ldapbody.h.ldap openssh-5.9p0/ldapbody.h
1106--- openssh-5.9p0/ldapbody.h.ldap 2011-08-30 15:57:13.087150596 +0200
1107+++ openssh-5.9p0/ldapbody.h 2011-08-30 15:57:13.091149461 +0200
1108@@ -0,0 +1,37 @@
1109+/* $OpenBSD: ldapbody.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
1110+/*
1111+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
1112+ *
1113+ * Redistribution and use in source and binary forms, with or without
1114+ * modification, are permitted provided that the following conditions
1115+ * are met:
1116+ * 1. Redistributions of source code must retain the above copyright
1117+ * notice, this list of conditions and the following disclaimer.
1118+ * 2. Redistributions in binary form must reproduce the above copyright
1119+ * notice, this list of conditions and the following disclaimer in the
1120+ * documentation and/or other materials provided with the distribution.
1121+ *
1122+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
1123+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
1124+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
1125+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
1126+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
1127+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
1128+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
1129+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
1130+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
1131+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1132+ */
1133+
1134+#ifndef LDAPBODY_H
1135+#define LDAPBODY_H
1136+
1137+#include <stdio.h>
1138+
1139+void ldap_checkconfig(void);
1140+void ldap_do_connect(void);
1141+void process_user(const char *, FILE *);
1142+void ldap_do_close(void);
1143+
1144+#endif /* LDAPBODY_H */
1145+
1146diff -up openssh-5.9p0/ldapconf.c.ldap openssh-5.9p0/ldapconf.c
1147--- openssh-5.9p0/ldapconf.c.ldap 2011-08-30 15:57:13.164036922 +0200
1148+++ openssh-5.9p0/ldapconf.c 2011-08-30 15:57:13.171065499 +0200
1149@@ -0,0 +1,682 @@
1150+/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
1151+/*
1152+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
1153+ *
1154+ * Redistribution and use in source and binary forms, with or without
1155+ * modification, are permitted provided that the following conditions
1156+ * are met:
1157+ * 1. Redistributions of source code must retain the above copyright
1158+ * notice, this list of conditions and the following disclaimer.
1159+ * 2. Redistributions in binary form must reproduce the above copyright
1160+ * notice, this list of conditions and the following disclaimer in the
1161+ * documentation and/or other materials provided with the distribution.
1162+ *
1163+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
1164+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
1165+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
1166+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
1167+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
1168+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
1169+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
1170+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
1171+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
1172+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1173+ */
1174+
1175+#include "ldapincludes.h"
1176+#include "ldap-helper.h"
1177+#include "log.h"
1178+#include "misc.h"
1179+#include "xmalloc.h"
1180+#include "ldapconf.h"
1181+#include <unistd.h>
1182+#include <string.h>
1183+
1184+/* Keyword tokens. */
1185+
1186+typedef enum {
1187+ lBadOption,
1188+ lHost, lURI, lBase, lBindDN, lBindPW, lRootBindDN,
1189+ lScope, lDeref, lPort, lTimeLimit, lBind_TimeLimit,
1190+ lLdap_Version, lBind_Policy, lSSLPath, lSSL, lReferrals,
1191+ lRestart, lTLS_CheckPeer, lTLS_CaCertFile,
1192+ lTLS_CaCertDir, lTLS_Ciphers, lTLS_Cert, lTLS_Key,
1193+ lTLS_RandFile, lLogDir, lDebug, lSSH_Filter,
1194+ lDeprecated, lUnsupported
1195+} OpCodes;
1196+
1197+/* Textual representations of the tokens. */
1198+
1199+static struct {
1200+ const char *name;
1201+ OpCodes opcode;
1202+} keywords[] = {
1203+ { "URI", lURI },
1204+ { "Base", lBase },
1205+ { "BindDN", lBindDN },
1206+ { "BindPW", lBindPW },
1207+ { "RootBindDN", lRootBindDN },
1208+ { "Host", lHost },
1209+ { "Port", lPort },
1210+ { "Scope", lScope },
1211+ { "Deref", lDeref },
1212+ { "TimeLimit", lTimeLimit },
1213+ { "TimeOut", lTimeLimit },
1214+ { "Bind_Timelimit", lBind_TimeLimit },
1215+ { "Network_TimeOut", lBind_TimeLimit },
1216+/*
1217+ * Todo
1218+ * SIZELIMIT
1219+ */
1220+ { "Ldap_Version", lLdap_Version },
1221+ { "Version", lLdap_Version },
1222+ { "Bind_Policy", lBind_Policy },
1223+ { "SSLPath", lSSLPath },
1224+ { "SSL", lSSL },
1225+ { "Referrals", lReferrals },
1226+ { "Restart", lRestart },
1227+ { "TLS_CheckPeer", lTLS_CheckPeer },
1228+ { "TLS_ReqCert", lTLS_CheckPeer },
1229+ { "TLS_CaCertFile", lTLS_CaCertFile },
1230+ { "TLS_CaCert", lTLS_CaCertFile },
1231+ { "TLS_CaCertDir", lTLS_CaCertDir },
1232+ { "TLS_Ciphers", lTLS_Ciphers },
1233+ { "TLS_Cipher_Suite", lTLS_Ciphers },
1234+ { "TLS_Cert", lTLS_Cert },
1235+ { "TLS_Certificate", lTLS_Cert },
1236+ { "TLS_Key", lTLS_Key },
1237+ { "TLS_RandFile", lTLS_RandFile },
1238+/*
1239+ * Todo
1240+ * TLS_CRLCHECK
1241+ * TLS_CRLFILE
1242+ */
1243+ { "LogDir", lLogDir },
1244+ { "Debug", lDebug },
1245+ { "SSH_Filter", lSSH_Filter },
1246+ { NULL, lBadOption }
1247+};
1248+
1249+/* Configuration ptions. */
1250+
1251+Options options;
1252+
1253+/*
1254+ * Returns the number of the token pointed to by cp or oBadOption.
1255+ */
1256+
1257+static OpCodes
1258+parse_token(const char *cp, const char *filename, int linenum)
1259+{
1260+ u_int i;
1261+
1262+ for (i = 0; keywords[i].name; i++)
1263+ if (strcasecmp(cp, keywords[i].name) == 0)
1264+ return keywords[i].opcode;
1265+
1266+ if (config_warning_config_file)
1267+ logit("%s: line %d: Bad configuration option: %s",
1268+ filename, linenum, cp);
1269+ return lBadOption;
1270+}
1271+
1272+/*
1273+ * Processes a single option line as used in the configuration files. This
1274+ * only sets those values that have not already been set.
1275+ */
1276+#define WHITESPACE " \t\r\n"
1277+
1278+static int
1279+process_config_line(char *line, const char *filename, int linenum)
1280+{
1281+ char *s, **charptr, **xstringptr, *endofnumber, *keyword, *arg;
1282+ char *rootbinddn = NULL;
1283+ int opcode, *intptr, value;
1284+ size_t len;
1285+
1286+ /* Strip trailing whitespace */
1287+ for (len = strlen(line) - 1; len > 0; len--) {
1288+ if (strchr(WHITESPACE, line[len]) == NULL)
1289+ break;
1290+ line[len] = '\0';
1291+ }
1292+
1293+ s = line;
1294+ /* Get the keyword. (Each line is supposed to begin with a keyword). */
1295+ if ((keyword = strdelim(&s)) == NULL)
1296+ return 0;
1297+ /* Ignore leading whitespace. */
1298+ if (*keyword == '\0')
1299+ keyword = strdelim(&s);
1300+ if (keyword == NULL || !*keyword || *keyword == '\n' || *keyword == '#')
1301+ return 0;
1302+
1303+ opcode = parse_token(keyword, filename, linenum);
1304+
1305+ switch (opcode) {
1306+ case lBadOption:
1307+ /* don't panic, but count bad options */
1308+ return -1;
1309+ /* NOTREACHED */
1310+
1311+ case lHost:
1312+ xstringptr = &options.host;
1313+parse_xstring:
1314+ if (!s || *s == '\0')
1315+ fatal("%s line %d: missing dn",filename,linenum);
1316+ if (*xstringptr == NULL)
1317+ *xstringptr = xstrdup(s);
1318+ return 0;
1319+
1320+ case lURI:
1321+ xstringptr = &options.uri;
1322+ goto parse_xstring;
1323+
1324+ case lBase:
1325+ xstringptr = &options.base;
1326+ goto parse_xstring;
1327+
1328+ case lBindDN:
1329+ xstringptr = &options.binddn;
1330+ goto parse_xstring;
1331+
1332+ case lBindPW:
1333+ charptr = &options.bindpw;
1334+parse_string:
1335+ arg = strdelim(&s);
1336+ if (!arg || *arg == '\0')
1337+ fatal("%.200s line %d: Missing argument.", filename, linenum);
1338+ if (*charptr == NULL)
1339+ *charptr = xstrdup(arg);
1340+ break;
1341+
1342+ case lRootBindDN:
1343+ xstringptr = &rootbinddn;
1344+ goto parse_xstring;
1345+
1346+ case lScope:
1347+ intptr = &options.scope;
1348+ arg = strdelim(&s);
1349+ if (!arg || *arg == '\0')
1350+ fatal("%.200s line %d: Missing sub/one/base argument.", filename, linenum);
1351+ value = 0; /* To avoid compiler warning... */
1352+ if (strcasecmp (arg, "sub") == 0 || strcasecmp (arg, "subtree") == 0)
1353+ value = LDAP_SCOPE_SUBTREE;
1354+ else if (strcasecmp (arg, "one") == 0)
1355+ value = LDAP_SCOPE_ONELEVEL;
1356+ else if (strcasecmp (arg, "base") == 0)
1357+ value = LDAP_SCOPE_BASE;
1358+ else
1359+ fatal("%.200s line %d: Bad sub/one/base argument.", filename, linenum);
1360+ if (*intptr == -1)
1361+ *intptr = value;
1362+ break;
1363+
1364+ case lDeref:
1365+ intptr = &options.scope;
1366+ arg = strdelim(&s);
1367+ if (!arg || *arg == '\0')
1368+ fatal("%.200s line %d: Missing never/searching/finding/always argument.", filename, linenum);
1369+ value = 0; /* To avoid compiler warning... */
1370+ if (!strcasecmp (arg, "never"))
1371+ value = LDAP_DEREF_NEVER;
1372+ else if (!strcasecmp (arg, "searching"))
1373+ value = LDAP_DEREF_SEARCHING;
1374+ else if (!strcasecmp (arg, "finding"))
1375+ value = LDAP_DEREF_FINDING;
1376+ else if (!strcasecmp (arg, "always"))
1377+ value = LDAP_DEREF_ALWAYS;
1378+ else
1379+ fatal("%.200s line %d: Bad never/searching/finding/always argument.", filename, linenum);
1380+ if (*intptr == -1)
1381+ *intptr = value;
1382+ break;
1383+
1384+ case lPort:
1385+ intptr = &options.port;
1386+parse_int:
1387+ arg = strdelim(&s);
1388+ if (!arg || *arg == '\0')
1389+ fatal("%.200s line %d: Missing argument.", filename, linenum);
1390+ if (arg[0] < '0' || arg[0] > '9')
1391+ fatal("%.200s line %d: Bad number.", filename, linenum);
1392+
1393+ /* Octal, decimal, or hex format? */
1394+ value = strtol(arg, &endofnumber, 0);
1395+ if (arg == endofnumber)
1396+ fatal("%.200s line %d: Bad number.", filename, linenum);
1397+ if (*intptr == -1)
1398+ *intptr = value;
1399+ break;
1400+
1401+ case lTimeLimit:
1402+ intptr = &options.timelimit;
1403+parse_time:
1404+ arg = strdelim(&s);
1405+ if (!arg || *arg == '\0')
1406+ fatal("%s line %d: missing time value.",
1407+ filename, linenum);
1408+ if ((value = convtime(arg)) == -1)
1409+ fatal("%s line %d: invalid time value.",
1410+ filename, linenum);
1411+ if (*intptr == -1)
1412+ *intptr = value;
1413+ break;
1414+
1415+ case lBind_TimeLimit:
1416+ intptr = &options.bind_timelimit;
1417+ goto parse_time;
1418+
1419+ case lLdap_Version:
1420+ intptr = &options.ldap_version;
1421+ goto parse_int;
1422+
1423+ case lBind_Policy:
1424+ intptr = &options.bind_policy;
1425+ arg = strdelim(&s);
1426+ if (!arg || *arg == '\0')
1427+ fatal("%.200s line %d: Missing soft/hard argument.", filename, linenum);
1428+ value = 0; /* To avoid compiler warning... */
1429+ if (strcasecmp(arg, "hard") == 0 || strcasecmp(arg, "hard_open") == 0 || strcasecmp(arg, "hard_init") == 0)
1430+ value = 1;
1431+ else if (strcasecmp(arg, "soft") == 0)
1432+ value = 0;
1433+ else
1434+ fatal("%.200s line %d: Bad soft/hard argument.", filename, linenum);
1435+ if (*intptr == -1)
1436+ break;
1437+
1438+ case lSSLPath:
1439+ charptr = &options.sslpath;
1440+ goto parse_string;
1441+
1442+ case lSSL:
1443+ intptr = &options.ssl;
1444+ arg = strdelim(&s);
1445+ if (!arg || *arg == '\0')
1446+ fatal("%.200s line %d: Missing yes/no/start_tls argument.", filename, linenum);
1447+ value = 0; /* To avoid compiler warning... */
1448+ if (strcasecmp(arg, "yes") == 0 || strcasecmp(arg, "true") == 0 || strcasecmp(arg, "on") == 0)
1449+ value = SSL_LDAPS;
1450+ else if (strcasecmp(arg, "no") == 0 || strcasecmp(arg, "false") == 0 || strcasecmp(arg, "off") == 0)
1451+ value = SSL_OFF;
1452+ else if (!strcasecmp (arg, "start_tls"))
1453+ value = SSL_START_TLS;
1454+ else
1455+ fatal("%.200s line %d: Bad yes/no/start_tls argument.", filename, linenum);
1456+ if (*intptr == -1)
1457+ *intptr = value;
1458+ break;
1459+
1460+ case lReferrals:
1461+ intptr = &options.referrals;
1462+parse_flag:
1463+ arg = strdelim(&s);
1464+ if (!arg || *arg == '\0')
1465+ fatal("%.200s line %d: Missing yes/no argument.", filename, linenum);
1466+ value = 0; /* To avoid compiler warning... */
1467+ if (strcasecmp(arg, "yes") == 0 || strcasecmp(arg, "true") == 0 || strcasecmp(arg, "on") == 0)
1468+ value = 1;
1469+ else if (strcasecmp(arg, "no") == 0 || strcasecmp(arg, "false") == 0 || strcasecmp(arg, "off") == 0)
1470+ value = 0;
1471+ else
1472+ fatal("%.200s line %d: Bad yes/no argument.", filename, linenum);
1473+ if (*intptr == -1)
1474+ *intptr = value;
1475+ break;
1476+
1477+ case lRestart:
1478+ intptr = &options.restart;
1479+ goto parse_flag;
1480+
1481+ case lTLS_CheckPeer:
1482+ intptr = &options.tls_checkpeer;
1483+ arg = strdelim(&s);
1484+ if (!arg || *arg == '\0')
1485+ fatal("%.200s line %d: Missing never/hard/demand/alow/try argument.", filename, linenum);
1486+ value = 0; /* To avoid compiler warning... */
1487+ if (strcasecmp(arg, "never") == 0 || strcasecmp(arg, "no") == 0 || strcasecmp(arg, "false") == 0 || strcasecmp(arg, "off") == 0)
1488+ value = LDAP_OPT_X_TLS_NEVER;
1489+ else if (strcasecmp(arg, "hard") == 0 || strcasecmp(arg, "yes") == 0 || strcasecmp(arg, "true") == 0 || strcasecmp(arg, "on") == 0)
1490+ value = LDAP_OPT_X_TLS_HARD;
1491+ else if (strcasecmp(arg, "demand") == 0)
1492+ value = LDAP_OPT_X_TLS_DEMAND;
1493+ else if (strcasecmp(arg, "allow") == 0)
1494+ value = LDAP_OPT_X_TLS_ALLOW;
1495+ else if (strcasecmp(arg, "try") == 0)
1496+ value = LDAP_OPT_X_TLS_TRY;
1497+ else
1498+ fatal("%.200s line %d: Bad never/hard/demand/alow/try argument.", filename, linenum);
1499+ if (*intptr == -1)
1500+ break;
1501+
1502+ case lTLS_CaCertFile:
1503+ charptr = &options.tls_cacertfile;
1504+ goto parse_string;
1505+
1506+ case lTLS_CaCertDir:
1507+ charptr = &options.tls_cacertdir;
1508+ goto parse_string;
1509+
1510+ case lTLS_Ciphers:
1511+ xstringptr = &options.tls_ciphers;
1512+ goto parse_xstring;
1513+
1514+ case lTLS_Cert:
1515+ charptr = &options.tls_cert;
1516+ goto parse_string;
1517+
1518+ case lTLS_Key:
1519+ charptr = &options.tls_key;
1520+ goto parse_string;
1521+
1522+ case lTLS_RandFile:
1523+ charptr = &options.tls_randfile;
1524+ goto parse_string;
1525+
1526+ case lLogDir:
1527+ charptr = &options.logdir;
1528+ goto parse_string;
1529+
1530+ case lDebug:
1531+ intptr = &options.debug;
1532+ goto parse_int;
1533+
1534+ case lSSH_Filter:
1535+ xstringptr = &options.ssh_filter;
1536+ goto parse_xstring;
1537+
1538+ case lDeprecated:
1539+ debug("%s line %d: Deprecated option \"%s\"",
1540+ filename, linenum, keyword);
1541+ return 0;
1542+
1543+ case lUnsupported:
1544+ error("%s line %d: Unsupported option \"%s\"",
1545+ filename, linenum, keyword);
1546+ return 0;
1547+
1548+ default:
1549+ fatal("process_config_line: Unimplemented opcode %d", opcode);
1550+ }
1551+
1552+ /* Check that there is no garbage at end of line. */
1553+ if ((arg = strdelim(&s)) != NULL && *arg != '\0') {
1554+ fatal("%.200s line %d: garbage at end of line; \"%.200s\".",
1555+ filename, linenum, arg);
1556+ }
1557+ return 0;
1558+}
1559+
1560+/*
1561+ * Reads the config file and modifies the options accordingly. Options
1562+ * should already be initialized before this call. This never returns if
1563+ * there is an error. If the file does not exist, this returns 0.
1564+ */
1565+
1566+void
1567+read_config_file(const char *filename)
1568+{
1569+ FILE *f;
1570+ char line[1024];
1571+ int active, linenum;
1572+ int bad_options = 0;
1573+ struct stat sb;
1574+
1575+ if ((f = fopen(filename, "r")) == NULL)
1576+ fatal("fopen %s: %s", filename, strerror(errno));
1577+
1578+ if (fstat(fileno(f), &sb) == -1)
1579+ fatal("fstat %s: %s", filename, strerror(errno));
1580+ if (((sb.st_uid != 0 && sb.st_uid != getuid()) ||
1581+ (sb.st_mode & 022) != 0))
1582+ fatal("Bad owner or permissions on %s", filename);
1583+
1584+ debug("Reading configuration data %.200s", filename);
1585+
1586+ /*
1587+ * Mark that we are now processing the options. This flag is turned
1588+ * on/off by Host specifications.
1589+ */
1590+ active = 1;
1591+ linenum = 0;
1592+ while (fgets(line, sizeof(line), f)) {
1593+ /* Update line number counter. */
1594+ linenum++;
1595+ if (process_config_line(line, filename, linenum) != 0)
1596+ bad_options++;
1597+ }
1598+ fclose(f);
1599+ if ((bad_options > 0) && config_exclusive_config_file)
1600+ fatal("%s: terminating, %d bad configuration options",
1601+ filename, bad_options);
1602+}
1603+
1604+/*
1605+ * Initializes options to special values that indicate that they have not yet
1606+ * been set. Read_config_file will only set options with this value. Options
1607+ * are processed in the following order: command line, user config file,
1608+ * system config file. Last, fill_default_options is called.
1609+ */
1610+
1611+void
1612+initialize_options(void)
1613+{
1614+ memset(&options, 'X', sizeof(options));
1615+ options.host = NULL;
1616+ options.uri = NULL;
1617+ options.base = NULL;
1618+ options.binddn = NULL;
1619+ options.bindpw = NULL;
1620+ options.scope = -1;
1621+ options.deref = -1;
1622+ options.port = -1;
1623+ options.timelimit = -1;
1624+ options.bind_timelimit = -1;
1625+ options.ldap_version = -1;
1626+ options.bind_policy = -1;
1627+ options.sslpath = NULL;
1628+ options.ssl = -1;
1629+ options.referrals = -1;
1630+ options.restart = -1;
1631+ options.tls_checkpeer = -1;
1632+ options.tls_cacertfile = NULL;
1633+ options.tls_cacertdir = NULL;
1634+ options.tls_ciphers = NULL;
1635+ options.tls_cert = NULL;
1636+ options.tls_key = NULL;
1637+ options.tls_randfile = NULL;
1638+ options.logdir = NULL;
1639+ options.debug = -1;
1640+ options.ssh_filter = NULL;
1641+}
1642+
1643+/*
1644+ * Called after processing other sources of option data, this fills those
1645+ * options for which no value has been specified with their default values.
1646+ */
1647+
1648+void
1649+fill_default_options(void)
1650+{
1651+ if (options.uri != NULL) {
1652+ LDAPURLDesc *ludp;
1653+
1654+ if (ldap_url_parse(options.uri, &ludp) == LDAP_SUCCESS) {
1655+ if (options.ssl == -1) {
1656+ if (strcmp (ludp->lud_scheme, "ldap") == 0)
1657+ options.ssl = 2;
1658+ if (strcmp (ludp->lud_scheme, "ldapi") == 0)
1659+ options.ssl = 0;
1660+ else if (strcmp (ludp->lud_scheme, "ldaps") == 0)
1661+ options.ssl = 1;
1662+ }
1663+ if (options.host == NULL)
1664+ options.host = xstrdup (ludp->lud_host);
1665+ if (options.port == -1)
1666+ options.port = ludp->lud_port;
1667+
1668+ ldap_free_urldesc (ludp);
1669+ }
1670+ }
1671+ if (options.ssl == -1)
1672+ options.ssl = SSL_START_TLS;
1673+ if (options.port == -1)
1674+ options.port = (options.ssl == 0) ? 389 : 636;
1675+ if (options.uri == NULL) {
1676+ int len;
1677+#define MAXURILEN 4096
1678+
1679+ options.uri = xmalloc (MAXURILEN);
1680+ len = snprintf (options.uri, MAXURILEN, "ldap%s://%s:%d",
1681+ (options.ssl == 0) ? "" : "s", options.host, options.port);
1682+ options.uri[MAXURILEN - 1] = 0;
1683+ options.uri = xrealloc (options.uri, len + 1, 1);
1684+ }
1685+ if (options.binddn == NULL)
1686+ options.binddn = "";
1687+ if (options.bindpw == NULL)
1688+ options.bindpw = "";
1689+ if (options.scope == -1)
1690+ options.scope = LDAP_SCOPE_SUBTREE;
1691+ if (options.deref == -1)
1692+ options.deref = LDAP_DEREF_NEVER;
1693+ if (options.timelimit == -1)
1694+ options.timelimit = 10;
1695+ if (options.bind_timelimit == -1)
1696+ options.bind_timelimit = 10;
1697+ if (options.ldap_version == -1)
1698+ options.ldap_version = 3;
1699+ if (options.bind_policy == -1)
1700+ options.bind_policy = 1;
1701+ if (options.referrals == -1)
1702+ options.referrals = 1;
1703+ if (options.restart == -1)
1704+ options.restart = 1;
1705+ if (options.tls_checkpeer == -1)
1706+ options.tls_checkpeer = LDAP_OPT_X_TLS_HARD;
1707+ if (options.debug == -1)
1708+ options.debug = 0;
1709+ if (options.ssh_filter == NULL)
1710+ options.ssh_filter = "";
1711+}
1712+
1713+static const char *
1714+lookup_opcode_name(OpCodes code)
1715+{
1716+ u_int i;
1717+
1718+ for (i = 0; keywords[i].name != NULL; i++)
1719+ if (keywords[i].opcode == code)
1720+ return(keywords[i].name);
1721+ return "UNKNOWN";
1722+}
1723+
1724+static void
1725+dump_cfg_string(OpCodes code, const char *val)
1726+{
1727+ if (val == NULL)
1728+ debug3("%s <UNDEFINED>", lookup_opcode_name(code));
1729+ else
1730+ debug3("%s %s", lookup_opcode_name(code), val);
1731+}
1732+
1733+static void
1734+dump_cfg_int(OpCodes code, int val)
1735+{
1736+ if (val == -1)
1737+ debug3("%s <UNDEFINED>", lookup_opcode_name(code));
1738+ else
1739+ debug3("%s %d", lookup_opcode_name(code), val);
1740+}
1741+
1742+struct names {
1743+ int value;
1744+ char *name;
1745+};
1746+
1747+static void
1748+dump_cfg_namedint(OpCodes code, int val, struct names *names)
1749+{
1750+ u_int i;
1751+
1752+ if (val == -1)
1753+ debug3("%s <UNDEFINED>", lookup_opcode_name(code));
1754+ else {
1755+ for (i = 0; names[i].value != -1; i++)
1756+ if (names[i].value == val) {
1757+ debug3("%s %s", lookup_opcode_name(code), names[i].name);
1758+ return;
1759+ }
1760+ debug3("%s unknown: %d", lookup_opcode_name(code), val);
1761+ }
1762+}
1763+
1764+static struct names _yesnotls[] = {
1765+ { 0, "No" },
1766+ { 1, "Yes" },
1767+ { 2, "Start_TLS" },
1768+ { -1, NULL }};
1769+
1770+static struct names _scope[] = {
1771+ { LDAP_SCOPE_BASE, "Base" },
1772+ { LDAP_SCOPE_ONELEVEL, "One" },
1773+ { LDAP_SCOPE_SUBTREE, "Sub"},
1774+ { -1, NULL }};
1775+
1776+static struct names _deref[] = {
1777+ { LDAP_DEREF_NEVER, "Never" },
1778+ { LDAP_DEREF_SEARCHING, "Searching" },
1779+ { LDAP_DEREF_FINDING, "Finding" },
1780+ { LDAP_DEREF_ALWAYS, "Always" },
1781+ { -1, NULL }};
1782+
1783+static struct names _yesno[] = {
1784+ { 0, "No" },
1785+ { 1, "Yes" },
1786+ { -1, NULL }};
1787+
1788+static struct names _bindpolicy[] = {
1789+ { 0, "Soft" },
1790+ { 1, "Hard" },
1791+ { -1, NULL }};
1792+
1793+static struct names _checkpeer[] = {
1794+ { LDAP_OPT_X_TLS_NEVER, "Never" },
1795+ { LDAP_OPT_X_TLS_HARD, "Hard" },
1796+ { LDAP_OPT_X_TLS_DEMAND, "Demand" },
1797+ { LDAP_OPT_X_TLS_ALLOW, "Allow" },
1798+ { LDAP_OPT_X_TLS_TRY, "TRY" },
1799+ { -1, NULL }};
1800+
1801+void
1802+dump_config(void)
1803+{
1804+ dump_cfg_string(lURI, options.uri);
1805+ dump_cfg_string(lHost, options.host);
1806+ dump_cfg_int(lPort, options.port);
1807+ dump_cfg_namedint(lSSL, options.ssl, _yesnotls);
1808+ dump_cfg_int(lLdap_Version, options.ldap_version);
1809+ dump_cfg_int(lTimeLimit, options.timelimit);
1810+ dump_cfg_int(lBind_TimeLimit, options.bind_timelimit);
1811+ dump_cfg_string(lBase, options.base);
1812+ dump_cfg_string(lBindDN, options.binddn);
1813+ dump_cfg_string(lBindPW, options.bindpw);
1814+ dump_cfg_namedint(lScope, options.scope, _scope);
1815+ dump_cfg_namedint(lDeref, options.deref, _deref);
1816+ dump_cfg_namedint(lReferrals, options.referrals, _yesno);
1817+ dump_cfg_namedint(lRestart, options.restart, _yesno);
1818+ dump_cfg_namedint(lBind_Policy, options.bind_policy, _bindpolicy);
1819+ dump_cfg_string(lSSLPath, options.sslpath);
1820+ dump_cfg_namedint(lTLS_CheckPeer, options.tls_checkpeer, _checkpeer);
1821+ dump_cfg_string(lTLS_CaCertFile, options.tls_cacertfile);
1822+ dump_cfg_string(lTLS_CaCertDir, options.tls_cacertdir);
1823+ dump_cfg_string(lTLS_Ciphers, options.tls_ciphers);
1824+ dump_cfg_string(lTLS_Cert, options.tls_cert);
1825+ dump_cfg_string(lTLS_Key, options.tls_key);
1826+ dump_cfg_string(lTLS_RandFile, options.tls_randfile);
1827+ dump_cfg_string(lLogDir, options.logdir);
1828+ dump_cfg_int(lDebug, options.debug);
1829+ dump_cfg_string(lSSH_Filter, options.ssh_filter);
1830+}
1831+
1832diff -up openssh-5.9p0/ldapconf.h.ldap openssh-5.9p0/ldapconf.h
1833--- openssh-5.9p0/ldapconf.h.ldap 2011-08-30 15:57:13.265149057 +0200
1834+++ openssh-5.9p0/ldapconf.h 2011-08-30 15:57:13.271153923 +0200
1835@@ -0,0 +1,71 @@
1836+/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
1837+/*
1838+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
1839+ *
1840+ * Redistribution and use in source and binary forms, with or without
1841+ * modification, are permitted provided that the following conditions
1842+ * are met:
1843+ * 1. Redistributions of source code must retain the above copyright
1844+ * notice, this list of conditions and the following disclaimer.
1845+ * 2. Redistributions in binary form must reproduce the above copyright
1846+ * notice, this list of conditions and the following disclaimer in the
1847+ * documentation and/or other materials provided with the distribution.
1848+ *
1849+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
1850+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
1851+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
1852+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
1853+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
1854+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
1855+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
1856+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
1857+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
1858+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1859+ */
1860+
1861+#ifndef LDAPCONF_H
1862+#define LDAPCONF_H
1863+
1864+#define SSL_OFF 0
1865+#define SSL_LDAPS 1
1866+#define SSL_START_TLS 2
1867+
1868+/* Data structure for representing option data. */
1869+
1870+typedef struct {
1871+ char *host;
1872+ char *uri;
1873+ char *base;
1874+ char *binddn;
1875+ char *bindpw;
1876+ int scope;
1877+ int deref;
1878+ int port;
1879+ int timelimit;
1880+ int bind_timelimit;
1881+ int ldap_version;
1882+ int bind_policy;
1883+ char *sslpath;
1884+ int ssl;
1885+ int referrals;
1886+ int restart;
1887+ int tls_checkpeer;
1888+ char *tls_cacertfile;
1889+ char *tls_cacertdir;
1890+ char *tls_ciphers;
1891+ char *tls_cert;
1892+ char *tls_key;
1893+ char *tls_randfile;
1894+ char *logdir;
1895+ int debug;
1896+ char *ssh_filter;
1897+} Options;
1898+
1899+extern Options options;
1900+
1901+void read_config_file(const char *);
1902+void initialize_options(void);
1903+void fill_default_options(void);
1904+void dump_config(void);
1905+
1906+#endif /* LDAPCONF_H */
1907diff -up openssh-5.9p0/ldapincludes.h.ldap openssh-5.9p0/ldapincludes.h
1908--- openssh-5.9p0/ldapincludes.h.ldap 2011-08-30 15:57:13.344023601 +0200
1909+++ openssh-5.9p0/ldapincludes.h 2011-08-30 15:57:13.348024596 +0200
1910@@ -0,0 +1,41 @@
1911+/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
1912+/*
1913+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
1914+ *
1915+ * Redistribution and use in source and binary forms, with or without
1916+ * modification, are permitted provided that the following conditions
1917+ * are met:
1918+ * 1. Redistributions of source code must retain the above copyright
1919+ * notice, this list of conditions and the following disclaimer.
1920+ * 2. Redistributions in binary form must reproduce the above copyright
1921+ * notice, this list of conditions and the following disclaimer in the
1922+ * documentation and/or other materials provided with the distribution.
1923+ *
1924+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
1925+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
1926+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
1927+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
1928+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
1929+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
1930+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
1931+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
1932+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
1933+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1934+ */
1935+
1936+#ifndef LDAPINCLUDES_H
1937+#define LDAPINCLUDES_H
1938+
1939+#include "includes.h"
1940+
1941+#ifdef HAVE_LBER_H
1942+#include <lber.h>
1943+#endif
1944+#ifdef HAVE_LDAP_H
1945+#include <ldap.h>
1946+#endif
1947+#ifdef HAVE_LDAP_SSL_H
1948+#include <ldap_ssl.h>
1949+#endif
1950+
1951+#endif /* LDAPINCLUDES_H */
1952diff -up openssh-5.9p0/ldapmisc.c.ldap openssh-5.9p0/ldapmisc.c
1953--- openssh-5.9p0/ldapmisc.c.ldap 2011-08-30 15:57:13.429148896 +0200
1954+++ openssh-5.9p0/ldapmisc.c 2011-08-30 15:57:13.433150396 +0200
1955@@ -0,0 +1,79 @@
1956+
1957+#include "ldapincludes.h"
1958+#include "ldapmisc.h"
1959+
1960+#ifndef HAVE_LDAP_GET_LDERRNO
1961+int
1962+ldap_get_lderrno (LDAP * ld, char **m, char **s)
1963+{
1964+#ifdef HAVE_LDAP_GET_OPTION
1965+ int rc;
1966+#endif
1967+ int lderrno;
1968+
1969+#if defined(HAVE_LDAP_GET_OPTION) && defined(LDAP_OPT_ERROR_NUMBER)
1970+ if ((rc = ldap_get_option (ld, LDAP_OPT_ERROR_NUMBER, &lderrno)) != LDAP_SUCCESS)
1971+ return rc;
1972+#else
1973+ lderrno = ld->ld_errno;
1974+#endif
1975+
1976+ if (s != NULL) {
1977+#if defined(HAVE_LDAP_GET_OPTION) && defined(LDAP_OPT_ERROR_STRING)
1978+ if ((rc = ldap_get_option (ld, LDAP_OPT_ERROR_STRING, s)) != LDAP_SUCCESS)
1979+ return rc;
1980+#else
1981+ *s = ld->ld_error;
1982+#endif
1983+ }
1984+
1985+ if (m != NULL) {
1986+#if defined(HAVE_LDAP_GET_OPTION) && defined(LDAP_OPT_MATCHED_DN)
1987+ if ((rc = ldap_get_option (ld, LDAP_OPT_MATCHED_DN, m)) != LDAP_SUCCESS)
1988+ return rc;
1989+#else
1990+ *m = ld->ld_matched;
1991+#endif
1992+ }
1993+
1994+ return lderrno;
1995+}
1996+#endif
1997+
1998+#ifndef HAVE_LDAP_SET_LDERRNO
1999+int
2000+ldap_set_lderrno (LDAP * ld, int lderrno, const char *m, const char *s)
2001+{
2002+#ifdef HAVE_LDAP_SET_OPTION
2003+ int rc;
2004+#endif
2005+
2006+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_ERROR_NUMBER)
2007+ if ((rc = ldap_set_option (ld, LDAP_OPT_ERROR_NUMBER, &lderrno)) != LDAP_SUCCESS)
2008+ return rc;
2009+#else
2010+ ld->ld_errno = lderrno;
2011+#endif
2012+
2013+ if (s != NULL) {
2014+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_ERROR_STRING)
2015+ if ((rc = ldap_set_option (ld, LDAP_OPT_ERROR_STRING, s)) != LDAP_SUCCESS)
2016+ return rc;
2017+#else
2018+ ld->ld_error = s;
2019+#endif
2020+ }
2021+
2022+ if (m != NULL) {
2023+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_MATCHED_DN)
2024+ if ((rc = ldap_set_option (ld, LDAP_OPT_MATCHED_DN, m)) != LDAP_SUCCESS)
2025+ return rc;
2026+#else
2027+ ld->ld_matched = m;
2028+#endif
2029+ }
2030+
2031+ return LDAP_SUCCESS;
2032+}
2033+#endif
2034+
2035diff -up openssh-5.9p0/ldapmisc.h.ldap openssh-5.9p0/ldapmisc.h
2036--- openssh-5.9p0/ldapmisc.h.ldap 2011-08-30 15:57:13.531150853 +0200
2037+++ openssh-5.9p0/ldapmisc.h 2011-08-30 15:57:13.537153831 +0200
2038@@ -0,0 +1,35 @@
2039+/* $OpenBSD: ldapbody.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
2040+/*
2041+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
2042+ *
2043+ * Redistribution and use in source and binary forms, with or without
2044+ * modification, are permitted provided that the following conditions
2045+ * are met:
2046+ * 1. Redistributions of source code must retain the above copyright
2047+ * notice, this list of conditions and the following disclaimer.
2048+ * 2. Redistributions in binary form must reproduce the above copyright
2049+ * notice, this list of conditions and the following disclaimer in the
2050+ * documentation and/or other materials provided with the distribution.
2051+ *
2052+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
2053+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
2054+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
2055+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
2056+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
2057+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
2058+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
2059+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
2060+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
2061+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
2062+ */
2063+
2064+#ifndef LDAPMISC_H
2065+#define LDAPMISC_H
2066+
2067+#include "ldapincludes.h"
2068+
2069+int ldap_get_lderrno (LDAP *, char **, char **);
2070+int ldap_set_lderrno (LDAP *, int, const char *, const char *);
2071+
2072+#endif /* LDAPMISC_H */
2073+
2074diff -up openssh-5.9p0/openssh-lpk-openldap.schema.ldap openssh-5.9p0/openssh-lpk-openldap.schema
2075--- openssh-5.9p0/openssh-lpk-openldap.schema.ldap 2011-08-30 15:57:13.607025841 +0200
2076+++ openssh-5.9p0/openssh-lpk-openldap.schema 2011-08-30 15:57:13.612150461 +0200
2077@@ -0,0 +1,21 @@
2078+#
2079+# LDAP Public Key Patch schema for use with openssh-ldappubkey
2080+# useful with PKA-LDAP also
2081+#
2082+# Author: Eric AUGE <eau@phear.org>
2083+#
2084+# Based on the proposal of : Mark Ruijter
2085+#
2086+
2087+
2088+# octetString SYNTAX
2089+attributetype ( 1.3.6.1.4.1.24552.500.1.1.1.13 NAME 'sshPublicKey'
2090+ DESC 'MANDATORY: OpenSSH Public key'
2091+ EQUALITY octetStringMatch
2092+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
2093+
2094+# printableString SYNTAX yes|no
2095+objectclass ( 1.3.6.1.4.1.24552.500.1.1.2.0 NAME 'ldapPublicKey' SUP top AUXILIARY
2096+ DESC 'MANDATORY: OpenSSH LPK objectclass'
2097+ MUST ( sshPublicKey $ uid )
2098+ )
2099diff -up openssh-5.9p0/openssh-lpk-sun.schema.ldap openssh-5.9p0/openssh-lpk-sun.schema
2100--- openssh-5.9p0/openssh-lpk-sun.schema.ldap 2011-08-30 15:57:13.696025724 +0200
2101+++ openssh-5.9p0/openssh-lpk-sun.schema 2011-08-30 15:57:13.699024704 +0200
2102@@ -0,0 +1,23 @@
2103+#
2104+# LDAP Public Key Patch schema for use with openssh-ldappubkey
2105+# useful with PKA-LDAP also
2106+#
2107+# Author: Eric AUGE <eau@phear.org>
2108+#
2109+# Schema for Sun Directory Server.
2110+# Based on the original schema, modified by Stefan Fischer.
2111+#
2112+
2113+dn: cn=schema
2114+
2115+# octetString SYNTAX
2116+attributeTypes: ( 1.3.6.1.4.1.24552.500.1.1.1.13 NAME 'sshPublicKey'
2117+ DESC 'MANDATORY: OpenSSH Public key'
2118+ EQUALITY octetStringMatch
2119+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
2120+
2121+# printableString SYNTAX yes|no
2122+objectClasses: ( 1.3.6.1.4.1.24552.500.1.1.2.0 NAME 'ldapPublicKey' SUP top AUXILIARY
2123+ DESC 'MANDATORY: OpenSSH LPK objectclass'
2124+ MUST ( sshPublicKey $ uid )
2125+ )
2126diff -up openssh-5.9p0/ssh-ldap-helper.8.ldap openssh-5.9p0/ssh-ldap-helper.8
2127--- openssh-5.9p0/ssh-ldap-helper.8.ldap 2011-08-30 15:57:13.772026539 +0200
2128+++ openssh-5.9p0/ssh-ldap-helper.8 2011-08-30 15:57:13.778026299 +0200
2129@@ -0,0 +1,79 @@
2130+.\" $OpenBSD: ssh-ldap-helper.8,v 1.1 2010/02/10 23:20:38 markus Exp $
2131+.\"
2132+.\" Copyright (c) 2010 Jan F. Chadima. All rights reserved.
2133+.\"
2134+.\" Permission to use, copy, modify, and distribute this software for any
2135+.\" purpose with or without fee is hereby granted, provided that the above
2136+.\" copyright notice and this permission notice appear in all copies.
2137+.\"
2138+.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
2139+.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
2140+.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
2141+.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
2142+.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
2143+.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
2144+.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
2145+.\"
2146+.Dd $Mdocdate: April 29 2010 $
2147+.Dt SSH-LDAP-HELPER 8
2148+.Os
2149+.Sh NAME
2150+.Nm ssh-ldap-helper
2151+.Nd sshd helper program for ldap support
2152+.Sh SYNOPSIS
2153+.Nm ssh-ldap-helper
2154+.Op Fl devw
2155+.Op Fl f Ar file
2156+.Op Fl s Ar user
2157+.Sh DESCRIPTION
2158+.Nm
2159+is used by
2160+.Xr sshd 1
2161+to access keys provided by an LDAP.
2162+.Nm
2163+is disabled by default and can only be enabled in the
2164+sshd configuration file
2165+.Pa /etc/ssh/sshd_config
2166+by setting
2167+.Cm AuthorizedKeysCommand
2168+to
2169+.Dq /usr/libexec/ssh-ldap-wrapper .
2170+.Pp
2171+.Nm
2172+is not intended to be invoked by the user, but from
2173+.Xr sshd 8 via
2174+.Xr ssh-ldap-wrapper .
2175+.Pp
2176+The options are as follows:
2177+.Bl -tag -width Ds
2178+.It Fl d
2179+Set the debug mode;
2180+.Nm
2181+prints all logs to stderr instead of syslog.
2182+.It Fl e
2183+Implies \-w;
2184+.Nm
2185+halts if it encounters an unknown item in the ldap.conf file.
2186+.It Fl f
2187+.Nm
2188+uses this file as the ldap configuration file instead of /etc/ssh/ldap.conf (default).
2189+.It Fl s
2190+.Nm
2191+prints out the user's keys to stdout and exits.
2192+.It Fl v
2193+Implies \-d;
2194+increases verbosity.
2195+.It Fl w
2196+.Nm
2197+writes warnings about unknown items in the ldap.conf configuration file.
2198+.El
2199+.Sh SEE ALSO
2200+.Xr sshd 8 ,
2201+.Xr sshd_config 5 ,
2202+.Xr ssh-ldap.conf 5 ,
2203+.Sh HISTORY
2204+.Nm
2205+first appeared in
2206+OpenSSH 5.5 + PKA-LDAP .
2207+.Sh AUTHORS
2208+.An Jan F. Chadima Aq jchadima@redhat.com
2209diff -up openssh-5.9p0/ssh-ldap-wrapper.ldap openssh-5.9p0/ssh-ldap-wrapper
2210--- openssh-5.9p0/ssh-ldap-wrapper.ldap 2011-08-30 15:57:13.854024986 +0200
2211+++ openssh-5.9p0/ssh-ldap-wrapper 2011-08-30 15:57:13.858149926 +0200
2212@@ -0,0 +1,4 @@
2213+#!/bin/sh
2214+
2215+exec /usr/libexec/openssh/ssh-ldap-helper -s "$1"
2216+
2217diff -up openssh-5.9p0/ssh-ldap.conf.5.ldap openssh-5.9p0/ssh-ldap.conf.5
2218--- openssh-5.9p0/ssh-ldap.conf.5.ldap 2011-08-30 15:57:13.934151066 +0200
2219+++ openssh-5.9p0/ssh-ldap.conf.5 2011-08-30 15:57:13.942024641 +0200
2220@@ -0,0 +1,376 @@
2221+.\" $OpenBSD: ssh-ldap.conf.5,v 1.1 2010/02/10 23:20:38 markus Exp $
2222+.\"
2223+.\" Copyright (c) 2010 Jan F. Chadima. All rights reserved.
2224+.\"
2225+.\" Permission to use, copy, modify, and distribute this software for any
2226+.\" purpose with or without fee is hereby granted, provided that the above
2227+.\" copyright notice and this permission notice appear in all copies.
2228+.\"
2229+.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
2230+.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
2231+.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
2232+.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
2233+.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
2234+.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
2235+.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
2236+.\"
2237+.Dd $Mdocdate: may 12 2010 $
2238+.Dt SSH-LDAP.CONF 5
2239+.Os
2240+.Sh NAME
2241+.Nm ssh-ldap.conf
2242+.Nd configuration file for ssh-ldap-helper
2243+.Sh SYNOPSIS
2244+.Nm /etc/ssh/ldap.conf
2245+.Sh DESCRIPTION
2246+.Xr ssh-ldap-helper 8
2247+reads configuration data from
2248+.Pa /etc/ssh/ldap.conf
2249+(or the file specified with
2250+.Fl f
2251+on the command line).
2252+The file contains keyword-argument pairs, one per line.
2253+Lines starting with
2254+.Ql #
2255+and empty lines are interpreted as comments.
2256+.Pp
2257+The value starts with the first non-blank character after
2258+the keyword's name, and terminates at the end of the line,
2259+or at the last sequence of blanks before the end of the line.
2260+Quoting values that contain blanks
2261+may be incorrect, as the quotes would become part of the value.
2262+The possible keywords and their meanings are as follows (note that
2263+keywords are case-insensitive, and arguments, on a case by case basis, may be case-sensitive).
2264+.Bl -tag -width Ds
2265+.It Cm URI
2266+The argument(s) are in the form
2267+.Pa ldap[si]://[name[:port]]
2268+and specify the URI(s) of an LDAP server(s) to which the
2269+.Xr ssh-ldap-helper 8
2270+should connect. The URI scheme may be any of
2271+.Dq ldap ,
2272+.Dq ldaps
2273+or
2274+.Dq ldapi ,
2275+which refer to LDAP over TCP, LDAP over SSL (TLS) and LDAP
2276+over IPC (UNIX domain sockets), respectively.
2277+Each server's name can be specified as a
2278+domain-style name or an IP address literal. Optionally, the
2279+server's name can followed by a ':' and the port number the LDAP
2280+server is listening on. If no port number is provided, the default
2281+port for the scheme is used (389 for ldap://, 636 for ldaps://).
2282+For LDAP over IPC, name is the name of the socket, and no port
2283+is required, nor allowed; note that directory separators must be
2284+URL-encoded, like any other characters that are special to URLs;
2285+A space separated list of URIs may be provided.
2286+There is no default.
2287+.It Cm Base
2288+Specifies the default base Distinguished Name (DN) to use when performing ldap operations.
2289+The base must be specified as a DN in LDAP format.
2290+There is no default.
2291+.It Cm BindDN
2292+Specifies the default BIND DN to use when connecting to the ldap server.
2293+The bind DN must be specified as a Distinguished Name in LDAP format.
2294+There is no default.
2295+.It Cm BindPW
2296+Specifies the default password to use when connecting to the ldap server via
2297+.Cm BindDN .
2298+There is no default.
2299+.It Cm RootBindDN
2300+Intentionaly does nothing. Recognized for compatibility reasons.
2301+.It Cm Host
2302+The argument(s) specifies the name(s) of an LDAP server(s) to which the
2303+.Xr ssh-ldap-helper 8
2304+should connect. Each server's name can be specified as a
2305+domain-style name or an IP address and optionally followed by a ':' and
2306+the port number the ldap server is listening on. A space-separated
2307+list of hosts may be provided.
2308+There is no default.
2309+.Cm Host
2310+is deprecated in favor of
2311+.Cm URI .
2312+.It Cm Port
2313+Specifies the default port used when connecting to LDAP servers(s).
2314+The port may be specified as a number.
2315+The default port is 389 for ldap:// or 636 for ldaps:// respectively.
2316+.Cm Port
2317+is deprecated in favor of
2318+.Cm URI .
2319+.It Cm Scope
2320+Specifies the starting point of an LDAP search and the depth from the base DN to which the search should descend.
2321+There are three options (values) that can be assigned to the
2322+.Cm Scope parameter:
2323+.Dq base ,
2324+.Dq one
2325+and
2326+.Dq subtree .
2327+Alias for the subtree is
2328+.Dq sub .
2329+The value
2330+.Dq base
2331+is used to indicate searching only the entry at the base DN, resulting in only that entry being returned (keeping in mind that it also has to meet the search filter criteria!).
2332+The value
2333+.Dq one
2334+is used to indicate searching all entries one level under the base DN, but not including the base DN and not including any entries under that one level under the base DN.
2335+The value
2336+.Dq subtree
2337+is used to indicate searching of all entries at all levels under and including the specified base DN.
2338+The default is
2339+.Dq subtree .
2340+.It Cm Deref
2341+Specifies how alias dereferencing is done when performing a search. There are four
2342+possible values that can be assigned to the
2343+.Cm Deref
2344+parameter:
2345+.Dq never ,
2346+.Dq searching ,
2347+.Dq finding ,
2348+and
2349+.Dq always .
2350+The value
2351+.Dq never
2352+means that the aliases are never dereferenced.
2353+The value
2354+.Dq searching
2355+means that the aliases are dereferenced in subordinates of the base object, but
2356+not in locating the base object of the search.
2357+The value
2358+.Dq finding
2359+means that the aliases are only dereferenced when locating the base object of the search.
2360+The value
2361+.Dq always
2362+means that the aliases are dereferenced both in searching and in locating the base object
2363+of the search.
2364+The default is
2365+.Dq never .
2366+.It Cm TimeLimit
2367+Specifies a time limit (in seconds) to use when performing searches.
2368+The number should be a non-negative integer. A
2369+.Cm TimeLimit
2370+of zero (0) specifies that the search time is unlimited. Please note that the server
2371+may still apply any server-side limit on the duration of a search operation.
2372+The default value is 10.
2373+.It Cm TimeOut
2374+Is an aliast to
2375+.Cm TimeLimit .
2376+.It Cm Bind_TimeLimit
2377+Specifies the timeout (in seconds) after which the poll(2)/select(2)
2378+following a connect(2) returns in case of no activity.
2379+The default value is 10.
2380+.It Cm Network_TimeOut
2381+Is an alias to
2382+.Cm Bind_TimeLimit .
2383+.It Cm Ldap_Version
2384+Specifies what version of the LDAP protocol should be used.
2385+The allowed values are 2 or 3. The default is 3.
2386+.It Cm Version
2387+Is an alias to
2388+.Cm Ldap_Version .
2389+.It Cm Bind_Policy
2390+Specifies the policy to use for reconnecting to an unavailable LDAP server. There are 2 available values:
2391+.Dq hard
2392+and
2393+.Dq soft.
2394+.Dq hard has 2 aliases
2395+.Dq hard_open
2396+and
2397+.Dq hard_init .
2398+The value
2399+.Dq hard
2400+means that reconects that the
2401+.Xr ssh-ldap-helper 8
2402+tries to reconnect to the LDAP server 5 times before failure. There is exponential backoff before retrying.
2403+The value
2404+.Dq soft
2405+means that
2406+.Xr ssh-ldap-helper 8
2407+fails immediately when it cannot connect to the LDAP seerver.
2408+The deault is
2409+.Dq hard .
2410+.It Cm SSLPath
2411+Specifies the path to the X.509 certificate database.
2412+There is no default.
2413+.It Cm SSL
2414+Specifies whether to use SSL/TLS or not.
2415+There are three allowed values:
2416+.Dq yes ,
2417+.Dq no
2418+and
2419+.Dq start_tls
2420+Both
2421+.Dq true
2422+and
2423+.Dq on
2424+are the aliases for
2425+.Dq yes .
2426+.Dq false
2427+and
2428+.Dq off
2429+are the aliases for
2430+.Dq no .
2431+If
2432+.Dq start_tls
2433+is specified then StartTLS is used rather than raw LDAP over SSL.
2434+The default for ldap:// is
2435+.Dq start_tls ,
2436+for ldaps://
2437+.Dq yes
2438+and
2439+.Dq no
2440+for the ldapi:// .
2441+In case of host based configuration the default is
2442+.Dq start_tls .
2443+.It Cm Referrals
2444+Specifies if the client should automatically follow referrals returned
2445+by LDAP servers.
2446+The value can be or
2447+.Dq yes
2448+or
2449+.Dq no .
2450+.Dq true
2451+and
2452+.Dq on
2453+are the aliases for
2454+.Dq yes .
2455+.Dq false
2456+and
2457+.Dq off
2458+are the aliases for
2459+.Dq no .
2460+The default is yes.
2461+.It Cm Restart
2462+Specifies whether the LDAP client library should restart the select(2) system call when interrupted.
2463+The value can be or
2464+.Dq yes
2465+or
2466+.Dq no .
2467+.Dq true
2468+and
2469+.Dq on
2470+are the aliases for
2471+.Dq yes .
2472+.Dq false
2473+and
2474+.Dq off
2475+are the aliases for
2476+.Dq no .
2477+The default is yes.
2478+.It Cm TLS_CheckPeer
2479+Specifies what checks to perform on server certificates in a TLS session,
2480+if any. The value
2481+can be specified as one of the following keywords:
2482+.Dq never ,
2483+.Dq hard ,
2484+.Dq demand ,
2485+.Dq allow
2486+and
2487+.Dq try .
2488+.Dq true ,
2489+.Dq on
2490+and
2491+.Dq yes
2492+are aliases for
2493+.Dq hard .
2494+.Dq false ,
2495+.Dq off
2496+and
2497+.Dq no
2498+are the aliases for
2499+.Dq never .
2500+The value
2501+.Dq never
2502+means that the client will not request or check any server certificate.
2503+The value
2504+.Dq allow
2505+means that the server certificate is requested. If no certificate is provided,
2506+the session proceeds normally. If a bad certificate is provided, it will
2507+be ignored and the session proceeds normally.
2508+The value
2509+.Dq try
2510+means that the server certificate is requested. If no certificate is provided,
2511+the session proceeds normally. If a bad certificate is provided,
2512+the session is immediately terminated.
2513+The value
2514+.Dq demand
2515+means that the server certificate is requested. If no
2516+certificate is provided, or a bad certificate is provided, the session
2517+is immediately terminated.
2518+The value
2519+.Dq hard
2520+is the same as
2521+.Dq demand .
2522+It requires an SSL connection. In the case of the plain conection the
2523+session is immediately terminated.
2524+The default is
2525+.Dq hard .
2526+.It Cm TLS_ReqCert
2527+Is an alias for
2528+.Cm TLS_CheckPeer .
2529+.It Cm TLS_CACertFile
2530+Specifies the file that contains certificates for all of the Certificate
2531+Authorities the client will recognize.
2532+There is no default.
2533+.It Cm TLS_CACert
2534+Is an alias for
2535+.Cm TLS_CACertFile .
2536+.It Cm TLS_CACertDIR
2537+Specifies the path of a directory that contains Certificate Authority
2538+certificates in separate individual files. The
2539+.Cm TLS_CACert
2540+is always used before
2541+.Cm TLS_CACertDir .
2542+The specified directory must be managed with the OpenSSL c_rehash utility.
2543+There is no default.
2544+.It Cm TLS_Ciphers
2545+Specifies acceptable cipher suite and preference order.
2546+The value should be a cipher specification for OpenSSL,
2547+e.g.,
2548+.Dq HIGH:MEDIUM:+SSLv2 .
2549+The default is
2550+.Dq ALL .
2551+.It Cm TLS_Cipher_Suite
2552+Is an alias for
2553+.Cm TLS_Ciphers .
2554+.It Cm TLS_Cert
2555+Specifies the file that contains the client certificate.
2556+There is no default.
2557+.It Cm TLS_Certificate
2558+Is an alias for
2559+.Cm TLS_Cert .
2560+.It Cm TLS_Key
2561+Specifies the file that contains the private key that matches the certificate
2562+stored in the
2563+.Cm TLS_Cert
2564+file. Currently, the private key must not be protected with a password, so
2565+it is of critical importance that the key file is protected carefully.
2566+There is no default.
2567+.It Cm TLS_RandFile
2568+Specifies the file to obtain random bits from when /dev/[u]random is
2569+not available. Generally set to the name of the EGD/PRNGD socket.
2570+The environment variable RANDFILE can also be used to specify the filename.
2571+There is no default.
2572+.It Cm LogDir
2573+Specifies the directory used for logging by the LDAP client library.
2574+There is no default.
2575+.It Cm Debug
2576+Specifies the debug level used for logging by the LDAP client library.
2577+There is no default.
2578+.It Cm SSH_Filter
2579+Specifies the user filter applied on the LDAP serch.
2580+The default is no filter.
2581+.El
2582+.Sh FILES
2583+.Bl -tag -width Ds
2584+.It Pa /etc/ssh/ldap.conf
2585+Ldap configuration file for
2586+.Xr ssh-ldap-helper 8 .
2587+.El
2588+.Sh "SEE ALSO"
2589+.Xr ldap.conf 5 ,
2590+.Xr ssh-ldap-helper 8
2591+.Sh HISTORY
2592+.Nm
2593+first appeared in
2594+OpenSSH 5.5 + PKA-LDAP .
2595+.Sh AUTHORS
2596+.An Jan F. Chadima Aq jchadima@redhat.com
OpenSSH free Secure Shell (SSH) implementation
This page took 0.56006 seconds and 4 git commands to generate.