]> git.pld-linux.org Git - packages/openssh.git/blame - openssh-ldap.patch
projects / packages / openssh.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
- up to 7.8p1
[packages/openssh.git] / openssh-ldap.patch
CommitLineData
3eddefd2
ER		 1diff -up openssh-6.2p1/configure.ac.ldap openssh-6.2p1/configure.ac
2--- openssh-6.2p1/configure.ac.ldap 2013-03-20 02:55:15.000000000 +0100
3+++ openssh-6.2p1/configure.ac 2013-03-25 21:27:15.888248071 +0100
4@@ -1509,6 +1509,106 @@ AC_ARG_WITH([audit],
5 esac ]
6 )
7
8+# Check whether user wants LDAP support
9+LDAP_MSG="no"
10+INSTALL_SSH_LDAP_HELPER=""
11+AC_ARG_WITH(ldap,
12+ [ --with-ldap[[=PATH]] Enable LDAP pubkey support (optionally in PATH)],
13+ [
14+ if test "x$withval" != "xno" ; then
15+
16+ INSTALL_SSH_LDAP_HELPER="yes"
17+ CPPFLAGS="$CPPFLAGS -DLDAP_DEPRECATED"
18+
19+ if test "x$withval" != "xyes" ; then
20+ CPPFLAGS="$CPPFLAGS -I${withval}/include"
21+ LDFLAGS="$LDFLAGS -L${withval}/lib"
22+ fi
23+
24+ AC_DEFINE([WITH_LDAP_PUBKEY], 1, [Enable LDAP pubkey support])
25+ LDAP_MSG="yes"
26+
27+ AC_CHECK_HEADERS(lber.h)
28+ AC_CHECK_HEADERS(ldap.h, , AC_MSG_ERROR(could not locate <ldap.h>))
29+ AC_CHECK_HEADERS(ldap_ssl.h)
30+
31+ AC_ARG_WITH(ldap-lib,
32+ [ --with-ldap-lib=type select ldap library [auto|netscape5|netscape4|netscape3|umich|openldap]])
33+
34+ if test -z "$with_ldap_lib"; then
35+ with_ldap_lib=auto
36+ fi
37+
38+ if test -z "$found_ldap_lib" -a \( $with_ldap_lib = auto -o $with_ldap_lib = umich -o $with_ldap_lib = openldap \); then
39+ AC_CHECK_LIB(lber, main, LIBS="-llber $LIBS" found_ldap_lib=yes)
40+ AC_CHECK_LIB(ldap, main, LIBS="-lldap $LIBS" found_ldap_lib=yes)
41+ fi
42+
43+ if test -z "$found_ldap_lib" -a \( $with_ldap_lib = auto -o $with_ldap_lib = netscape5 \); then
44+ AC_CHECK_LIB(ldap50, main, LIBS="-lldap50 -lssldap50 -lssl3 -lnss3 -lnspr4 -lprldap50 -lplc4 -lplds4 $LIBS" found_ldap_lib=yes)
45+ fi
46+
47+ if test -z "$found_ldap_lib" -a \( $with_ldap_lib = auto -o $with_ldap_lib = netscape4 \); then
48+ AC_CHECK_LIB(ldapssl41, main, LIBS="-lldapssl41 -lplc3 -lplds3 -lnspr3 $LIBS" found_ldap_lib=yes)
49+ if test -z "$found_ldap_lib"; then
50+ AC_CHECK_LIB(ldapssl40, main, LIBS="-lldapssl40 $LIBS" found_ldap_lib=yes)
51+ fi
52+ if test -z "$found_ldap_lib"; then
53+ AC_CHECK_LIB(ldap41, main, LIBS="-lldap41 $LIBS" found_ldap_lib=yes)
54+ fi
55+ if test -z "$found_ldap_lib"; then
56+ AC_CHECK_LIB(ldap40, main, LIBS="-lldap40 $LIBS" found_ldap_lib=yes)
57+ fi
58+ fi
59+
60+ if test -z "$found_ldap_lib" -a \( $with_ldap_lib = auto -o $with_ldap_lib = netscape3 \); then
61+ AC_CHECK_LIB(ldapssl30, main, LIBS="-lldapssl30 $LIBS" found_ldap_lib=yes)
62+ fi
63+
64+ if test -z "$found_ldap_lib"; then
65+ AC_MSG_ERROR(could not locate a valid LDAP library)
66+ fi
67+
68+ AC_MSG_CHECKING([for working LDAP support])
69+ AC_TRY_COMPILE(
70+ [#include <sys/types.h>
71+ #include <ldap.h>],
72+ [(void)ldap_init(0, 0);],
73+ [AC_MSG_RESULT(yes)],
74+ [
75+ AC_MSG_RESULT(no)
76+ AC_MSG_ERROR([** Incomplete or missing ldap libraries **])
77+ ])
78+ AC_CHECK_FUNCS( \
79+ ldap_init \
80+ ldap_get_lderrno \
81+ ldap_set_lderrno \
82+ ldap_parse_result \
83+ ldap_memfree \
84+ ldap_controls_free \
85+ ldap_set_option \
86+ ldap_get_option \
87+ ldapssl_init \
88+ ldap_start_tls_s \
89+ ldap_pvt_tls_set_option \
90+ ldap_initialize \
91+ )
92+ AC_CHECK_FUNCS(ldap_set_rebind_proc,
93+ AC_MSG_CHECKING([number arguments of ldap_set_rebind_proc])
94+ AC_TRY_COMPILE(
95+ [#include <lber.h>
96+ #include <ldap.h>],
97+ [ldap_set_rebind_proc(0, 0, 0);],
98+ [ac_cv_ldap_set_rebind_proc=3],
99+ [ac_cv_ldap_set_rebind_proc=2])
100+ AC_MSG_RESULT($ac_cv_ldap_set_rebind_proc)
101+ AC_DEFINE(LDAP_SET_REBIND_PROC_ARGS, $ac_cv_ldap_set_rebind_proc, [number arguments of ldap_set_rebind_proc])
102+ )
103+ fi
104+ ]
105+)
106+AC_SUBST(INSTALL_SSH_LDAP_HELPER)
107+
108 dnl Checks for library functions. Please keep in alphabetical order
109 AC_CHECK_FUNCS([ \
110 arc4random \
111diff -up openssh-6.2p1/HOWTO.ldap-keys.ldap openssh-6.2p1/HOWTO.ldap-keys
112--- openssh-6.2p1/HOWTO.ldap-keys.ldap 2013-03-25 21:27:15.889248078 +0100
113+++ openssh-6.2p1/HOWTO.ldap-keys 2013-03-25 21:27:15.889248078 +0100
501aed94
AM		 114@@ -0,0 +1,108 @@
115+
116+HOW TO START
117+
118+1) configure LDAP server
119+ * Use LDAP server documentation
120+2) add appropriate LDAP schema
121+ * For OpenLDAP or SunONE Use attached schema, otherwise you have to create it.
122+ * LDAP user entry
123+ User entry:
124+ - attached to the 'ldapPublicKey' objectclass
125+ - attached to the 'posixAccount' objectclass
126+ - with a filled 'sshPublicKey' attribute
127+3) insert users into LDAP
128+ * Use LDAP Tree management tool as useful
129+ * Entry in the LDAP server must respect 'posixAccount' and 'ldapPublicKey' which are defined in core.schema and the additionnal lpk.schema.
130+ * Example:
131+ dn: uid=captain,ou=commanders,dc=enterprise,dc=universe
132+ objectclass: top
133+ objectclass: person
134+ objectclass: organizationalPerson
135+ objectclass: posixAccount
136+ objectclass: ldapPublicKey
137+ description: Jonathan Archer
138+ userPassword: Porthos
139+ cn: onathan Archer
140+ sn: onathan Archer
141+ uid: captain
142+ uidNumber: 1001
143+ gidNumber: 1001
144+ homeDirectory: /home/captain
145+ sshPublicKey: ssh-rss AAAAB3.... =captain@universe
146+ sshPublicKey: command="kill -9 1" ssh-rss AAAAM5...
147+4) on the ssh side set in sshd_config
148+ * Set up the backend
3eddefd2
ER		 149+ AuthorizedKeysCommand /usr/libexec/openssh/ssh-ldap-wrapper
150+ AuthorizedKeysCommandUser <appropriate user to run LDAP>
501aed94
AM		 151+ * Do not forget to set
152+ PubkeyAuthentication yes
153+ * Swith off unnecessary auth methods
154+5) confugure ldap.conf
155+ * Default ldap.conf is placed in /etc/ssh
156+ * The configuration style is the same as other ldap based aplications
157+6) if necessary edit ssh-ldap-wrapper
158+ * There is a possibility to change ldap.conf location
159+ * There are some debug options
160+ * Example
161+ /usr/libexec/openssh -s -f /etc/ldap.conf -w -d >> /tmp/ldapdebuglog.txt
162+
163+HOW TO MIGRATE FROM LPK
164+
165+1) goto HOW TO START 4) .... the ldap schema is the same
166+
167+2) convert the group requests to the appropriate LDAP requests
168+
169+HOW TO SOLVE PROBLEMS
170+
171+1) use debug in sshd
172+ * /usr/sbin/sshd -d -d -d -d
173+2) use debug in ssh-ldap-helper
174+ * ssh-ldap-helper -d -d -d -d -s <username>
175+3) use tcpdump ... other ldap client etc.
176+
177+ADVANTAGES
178+
179+1) Blocking an user account can be done directly from LDAP (if sshd is using PubkeyAuthentication + AuthorizedKeysCommand with ldap only).
180+
181+DISADVANTAGES
182+
183+1) LDAP must be well configured, getting the public key of some user is not a problem, but if anonymous LDAP
184+ allows write to users dn, somebody could replace some user's public key by his own and impersonate some
185+ of your users in all your server farm -- be VERY CAREFUL.
186+2) With incomplete PKI the MITM attack when sshd is requesting the public key, could lead to a compromise of your servers allowing login
187+ as the impersonated user.
188+3) If LDAP server is down there may be no fallback on passwd auth.
189+
190+MISC.
191+
192+1) todo
193+ * Possibility to reuse the ssh-ldap-helper.
194+ * Tune the LDAP part to accept all possible LDAP configurations.
195+
196+2) differences from original lpk
197+ * No LDAP code in sshd.
198+ * Support for various LDAP platforms and configurations.
199+ * LDAP is configured in separate ldap.conf file.
200+
201+3) docs/link
202+ * http://pacsec.jp/core05/psj05-barisani-en.pdf
203+ * http://fritz.potsdam.edu/projects/openssh-lpk/
204+ * http://fritz.potsdam.edu/projects/sshgate/
205+ * http://dev.inversepath.com/trac/openssh-lpk
206+ * http://lam.sf.net/ ( http://lam.sourceforge.net/documentation/supportedSchemas.htm )
207+
208+4) contributors/ideas/greets
209+ - Eric AUGE <eau@phear.org>
210+ - Andrea Barisani <andrea@inversepath.com>
211+ - Falk Siemonsmeier.
212+ - Jacob Rief.
213+ - Michael Durchgraf.
214+ - frederic peters.
215+ - Finlay dobbie.
216+ - Stefan Fisher.
217+ - Robin H. Johnson.
218+ - Adrian Bridgett.
219+
220+5) Author
221+ Jan F. Chadima <jchadima@redhat.com>
222+
3eddefd2
ER		 223diff -up openssh-6.2p1/ldapbody.c.ldap openssh-6.2p1/ldapbody.c
224--- openssh-6.2p1/ldapbody.c.ldap 2013-03-25 21:27:15.889248078 +0100
225+++ openssh-6.2p1/ldapbody.c 2013-03-25 21:27:15.889248078 +0100
226@@ -0,0 +1,494 @@
227+/* $OpenBSD: ldapbody.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
228+/*
229+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
230+ *
231+ * Redistribution and use in source and binary forms, with or without
232+ * modification, are permitted provided that the following conditions
233+ * are met:
234+ * 1. Redistributions of source code must retain the above copyright
235+ * notice, this list of conditions and the following disclaimer.
236+ * 2. Redistributions in binary form must reproduce the above copyright
237+ * notice, this list of conditions and the following disclaimer in the
238+ * documentation and/or other materials provided with the distribution.
239+ *
240+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
241+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
242+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
243+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
244+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
245+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
246+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
247+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
248+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
249+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
250+ */
501aed94 251+
3eddefd2
ER		 252+#include "ldapincludes.h"
253+#include "log.h"
254+#include "xmalloc.h"
255+#include "ldapconf.h"
256+#include "ldapmisc.h"
257+#include "ldapbody.h"
258+#include <stdio.h>
259+#include <unistd.h>
501aed94 260+
3eddefd2
ER		 261+#define LDAPSEARCH_FORMAT "(&(objectclass=%s)(objectclass=ldapPublicKey)(uid=%s)%s)"
262+#define PUBKEYATTR "sshPublicKey"
263+#define LDAP_LOGFILE "%s/ldap.%d"
501aed94 264+
3eddefd2
ER		 265+static FILE *logfile = NULL;
266+static LDAP *ld;
501aed94 267+
3eddefd2
ER		 268+static char *attrs[] = {
269+ PUBKEYATTR,
270+ NULL
271+};
501aed94 272+
3eddefd2
ER		 273+void
274+ldap_checkconfig (void)
275+{
276+#ifdef HAVE_LDAP_INITIALIZE
277+ if (options.host == NULL && options.uri == NULL)
278+#else
279+ if (options.host == NULL)
280+#endif
281+ fatal ("missing \"host\" in config file");
282+}
501aed94 283+
3eddefd2
ER		 284+#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)
285+static int
286+_rebind_proc (LDAP * ld, LDAP_CONST char *url, int request, ber_int_t msgid)
287+{
288+ struct timeval timeout;
289+ int rc;
290+#if defined(HAVE_LDAP_PARSE_RESULT) && defined(HAVE_LDAP_CONTROLS_FREE)
291+ LDAPMessage *result;
292+#endif /* HAVE_LDAP_PARSE_RESULT && HAVE_LDAP_CONTROLS_FREE */
501aed94 293+
3eddefd2
ER		 294+ debug2 ("Doing LDAP rebind to %s", options.binddn);
295+ if (options.ssl == SSL_START_TLS) {
296+ if ((rc = ldap_start_tls_s (ld, NULL, NULL)) != LDAP_SUCCESS) {
297+ error ("ldap_starttls_s: %s", ldap_err2string (rc));
298+ return LDAP_OPERATIONS_ERROR;
299+ }
300+ }
501aed94 301+
3eddefd2
ER		 302+#if !defined(HAVE_LDAP_PARSE_RESULT) || !defined(HAVE_LDAP_CONTROLS_FREE)
303+ return ldap_simple_bind_s (ld, options.binddn, options.bindpw);
304+#else
305+ if (ldap_simple_bind(ld, options.binddn, options.bindpw) < 0)
306+ fatal ("ldap_simple_bind %s", ldap_err2string (ldap_get_lderrno (ld, 0, 0)));
501aed94 307+
3eddefd2
ER		 308+ timeout.tv_sec = options.bind_timelimit;
309+ timeout.tv_usec = 0;
310+ result = NULL;
311+ if ((rc = ldap_result (ld, msgid, FALSE, &timeout, &result)) < 1) {
312+ error ("ldap_result %s", ldap_err2string (ldap_get_lderrno (ld, 0, 0)));
313+ ldap_msgfree (result);
314+ return LDAP_OPERATIONS_ERROR;
315+ }
316+ debug3 ("LDAP rebind to %s succesfull", options.binddn);
317+ return rc;
318+#endif
319+}
320+#else
501aed94 321+
3eddefd2
ER		 322+static int
323+_rebind_proc (LDAP * ld, char **whop, char **credp, int *methodp, int freeit)
324+{
325+ if (freeit)
326+ return LDAP_SUCCESS;
501aed94 327+
3eddefd2
ER		 328+ *whop = strdup (options.binddn);
329+ *credp = strdup (options.bindpw);
330+ *methodp = LDAP_AUTH_SIMPLE;
331+ debug2 ("Doing LDAP rebind for %s", *whop);
332+ return LDAP_SUCCESS;
333+}
334+#endif
501aed94 335+
3eddefd2
ER		 336+void
337+ldap_do_connect(void)
338+{
339+ int rc, msgid, ld_errno = 0;
340+ struct timeval timeout;
341+#if defined(HAVE_LDAP_PARSE_RESULT) && defined(HAVE_LDAP_CONTROLS_FREE)
342+ int parserc;
343+ LDAPMessage *result;
344+ LDAPControl **controls;
345+ int reconnect = 0;
346+#endif /* HAVE_LDAP_PARSE_RESULT && HAVE_LDAP_CONTROLS_FREE */
501aed94 347+
3eddefd2 348+ debug ("LDAP do connect");
501aed94 349+
3eddefd2
ER		 350+retry:
351+ if (reconnect) {
352+ debug3 ("Reconnecting with ld_errno %d", ld_errno);
353+ if (options.bind_policy == 0 ||
354+ (ld_errno != LDAP_SERVER_DOWN && ld_errno != LDAP_TIMEOUT) ||
355+ reconnect > 5)
356+ fatal ("Cannot connect to LDAP server");
357+
358+ if (reconnect > 1)
359+ sleep (reconnect - 1);
501aed94 360+
3eddefd2
ER		 361+ if (ld != NULL) {
362+ ldap_unbind (ld);
363+ ld = NULL;
364+ }
365+ logit("reconnecting to LDAP server...");
366+ }
501aed94 367+
3eddefd2
ER		 368+ if (ld == NULL) {
369+ int rc;
370+ struct timeval tv;
501aed94 371+
3eddefd2
ER		 372+#ifdef HAVE_LDAP_SET_OPTION
373+ if (options.debug > 0) {
374+#ifdef LBER_OPT_LOG_PRINT_FILE
375+ if (options.logdir) {
376+ char *logfilename;
377+ int logfilenamelen;
501aed94 378+
3eddefd2
ER		 379+ logfilenamelen = strlen (LDAP_LOGFILE) + strlen ("000000") + strlen (options.logdir);
380+ logfilename = xmalloc (logfilenamelen);
381+ snprintf (logfilename, logfilenamelen, LDAP_LOGFILE, options.logdir, (int) getpid ());
382+ logfilename[logfilenamelen - 1] = 0;
383+ if ((logfile = fopen (logfilename, "a")) == NULL)
384+ fatal ("cannot append to %s: %s", logfilename, strerror (errno));
385+ debug3 ("LDAP debug into %s", logfilename);
386+ free (logfilename);
387+ ber_set_option (NULL, LBER_OPT_LOG_PRINT_FILE, logfile);
388+ }
389+#endif
390+ if (options.debug) {
391+#ifdef LBER_OPT_DEBUG_LEVEL
392+ ber_set_option (NULL, LBER_OPT_DEBUG_LEVEL, &options.debug);
393+#endif /* LBER_OPT_DEBUG_LEVEL */
394+#ifdef LDAP_OPT_DEBUG_LEVEL
395+ (void) ldap_set_option (NULL, LDAP_OPT_DEBUG_LEVEL, &options.debug);
396+#endif /* LDAP_OPT_DEBUG_LEVEL */
397+ debug3 ("Set LDAP debug to %d", options.debug);
398+ }
399+ }
400+#endif /* HAVE_LDAP_SET_OPTION */
501aed94 401+
3eddefd2
ER		 402+ ld = NULL;
403+#ifdef HAVE_LDAPSSL_INIT
404+ if (options.host != NULL) {
405+ if (options.ssl_on == SSL_LDAPS) {
406+ if ((rc = ldapssl_client_init (options.sslpath, NULL)) != LDAP_SUCCESS)
407+ fatal ("ldapssl_client_init %s", ldap_err2string (rc));
408+ debug3 ("LDAPssl client init");
409+ }
410+
411+ if (options.ssl_on != SSL_OFF) {
412+ if ((ld = ldapssl_init (options.host, options.port, TRUE)) == NULL)
413+ fatal ("ldapssl_init failed");
414+ debug3 ("LDAPssl init");
415+ }
416+ }
417+#endif /* HAVE_LDAPSSL_INIT */
418+
419+ /* continue with opening */
420+ if (ld == NULL) {
421+#if defined (HAVE_LDAP_START_TLS_S) || (defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_X_TLS))
422+ /* Some global TLS-specific options need to be set before we create our
423+ * session context, so we set them here. */
424+
425+#ifdef LDAP_OPT_X_TLS_RANDOM_FILE
426+ /* rand file */
427+ if (options.tls_randfile != NULL) {
428+ if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_RANDOM_FILE,
429+ options.tls_randfile)) != LDAP_SUCCESS)
430+ fatal ("ldap_set_option(LDAP_OPT_X_TLS_RANDOM_FILE): %s",
431+ ldap_err2string (rc));
432+ debug3 ("Set TLS random file %s", options.tls_randfile);
433+ }
434+#endif /* LDAP_OPT_X_TLS_RANDOM_FILE */
435+
436+ /* ca cert file */
437+ if (options.tls_cacertfile != NULL) {
438+ if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CACERTFILE,
439+ options.tls_cacertfile)) != LDAP_SUCCESS)
440+ error ("ldap_set_option(LDAP_OPT_X_TLS_CACERTFILE): %s",
441+ ldap_err2string (rc));
442+ debug3 ("Set TLS CA cert file %s ", options.tls_cacertfile);
443+ }
444+
445+ /* ca cert directory */
446+ if (options.tls_cacertdir != NULL) {
447+ if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CACERTDIR,
448+ options.tls_cacertdir)) != LDAP_SUCCESS)
449+ fatal ("ldap_set_option(LDAP_OPT_X_TLS_CACERTDIR): %s",
450+ ldap_err2string (rc));
451+ debug3 ("Set TLS CA cert dir %s ", options.tls_cacertdir);
452+ }
453+
454+ /* require cert? */
455+ if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_REQUIRE_CERT,
456+ &options.tls_checkpeer)) != LDAP_SUCCESS)
457+ fatal ("ldap_set_option(LDAP_OPT_X_TLS_REQUIRE_CERT): %s",
458+ ldap_err2string (rc));
459+ debug3 ("Set TLS check peer to %d ", options.tls_checkpeer);
460+
461+ /* set cipher suite, certificate and private key: */
462+ if (options.tls_ciphers != NULL) {
463+ if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CIPHER_SUITE,
464+ options.tls_ciphers)) != LDAP_SUCCESS)
465+ fatal ("ldap_set_option(LDAP_OPT_X_TLS_CIPHER_SUITE): %s",
466+ ldap_err2string (rc));
467+ debug3 ("Set TLS ciphers to %s ", options.tls_ciphers);
468+ }
469+
470+ /* cert file */
471+ if (options.tls_cert != NULL) {
472+ if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CERTFILE,
473+ options.tls_cert)) != LDAP_SUCCESS)
474+ fatal ("ldap_set_option(LDAP_OPT_X_TLS_CERTFILE): %s",
475+ ldap_err2string (rc));
476+ debug3 ("Set TLS cert file %s ", options.tls_cert);
477+ }
478+
479+ /* key file */
480+ if (options.tls_key != NULL) {
481+ if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_KEYFILE,
482+ options.tls_key)) != LDAP_SUCCESS)
483+ fatal ("ldap_set_option(LDAP_OPT_X_TLS_KEYFILE): %s",
484+ ldap_err2string (rc));
485+ debug3 ("Set TLS key file %s ", options.tls_key);
486+ }
487+#endif
488+#ifdef HAVE_LDAP_INITIALIZE
489+ if (options.uri != NULL) {
490+ if ((rc = ldap_initialize (&ld, options.uri)) != LDAP_SUCCESS)
491+ fatal ("ldap_initialize %s", ldap_err2string (rc));
492+ debug3 ("LDAP initialize %s", options.uri);
493+ }
494+ }
495+#endif /* HAVE_LDAP_INTITIALIZE */
496+
497+ /* continue with opening */
498+ if ((ld == NULL) && (options.host != NULL)) {
499+#ifdef HAVE_LDAP_INIT
500+ if ((ld = ldap_init (options.host, options.port)) == NULL)
501+ fatal ("ldap_init failed");
502+ debug3 ("LDAP init %s:%d", options.host, options.port);
503+#else
504+ if ((ld = ldap_open (options.host, options.port)) == NULL)
505+ fatal ("ldap_open failed");
506+ debug3 ("LDAP open %s:%d", options.host, options.port);
507+#endif /* HAVE_LDAP_INIT */
508+ }
509+
510+ if (ld == NULL)
511+ fatal ("no way to open ldap");
512+
513+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_X_TLS)
514+ if (options.ssl == SSL_LDAPS) {
515+ if ((rc = ldap_set_option (ld, LDAP_OPT_X_TLS, &options.tls_checkpeer)) != LDAP_SUCCESS)
516+ fatal ("ldap_set_option(LDAP_OPT_X_TLS) %s", ldap_err2string (rc));
517+ debug3 ("LDAP set LDAP_OPT_X_TLS_%d", options.tls_checkpeer);
518+ }
519+#endif /* LDAP_OPT_X_TLS */
520+
521+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_PROTOCOL_VERSION)
522+ (void) ldap_set_option (ld, LDAP_OPT_PROTOCOL_VERSION,
523+ &options.ldap_version);
524+#else
525+ ld->ld_version = options.ldap_version;
526+#endif
527+ debug3 ("LDAP set version to %d", options.ldap_version);
501aed94 528+
3eddefd2
ER		 529+#if LDAP_SET_REBIND_PROC_ARGS == 3
530+ ldap_set_rebind_proc (ld, _rebind_proc, NULL);
531+#elif LDAP_SET_REBIND_PROC_ARGS == 2
532+ ldap_set_rebind_proc (ld, _rebind_proc);
533+#else
534+#warning unknown LDAP_SET_REBIND_PROC_ARGS
535+#endif
536+ debug3 ("LDAP set rebind proc");
501aed94 537+
3eddefd2
ER		 538+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_DEREF)
539+ (void) ldap_set_option (ld, LDAP_OPT_DEREF, &options.deref);
540+#else
541+ ld->ld_deref = options.deref;
542+#endif
543+ debug3 ("LDAP set deref to %d", options.deref);
501aed94 544+
3eddefd2
ER		 545+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_TIMELIMIT)
546+ (void) ldap_set_option (ld, LDAP_OPT_TIMELIMIT,
547+ &options.timelimit);
548+#else
549+ ld->ld_timelimit = options.timelimit;
550+#endif
551+ debug3 ("LDAP set timelimit to %d", options.timelimit);
501aed94 552+
3eddefd2
ER		 553+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_X_OPT_CONNECT_TIMEOUT)
554+ /*
555+ * This is a new option in the Netscape SDK which sets
556+ * the TCP connect timeout. For want of a better value,
557+ * we use the bind_timelimit to control this.
558+ */
559+ timeout = options.bind_timelimit * 1000;
560+ (void) ldap_set_option (ld, LDAP_X_OPT_CONNECT_TIMEOUT, &timeout);
561+ debug3 ("LDAP set opt connect timeout to %d", timeout);
562+#endif
501aed94 563+
3eddefd2
ER		 564+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_NETWORK_TIMEOUT)
565+ tv.tv_sec = options.bind_timelimit;
566+ tv.tv_usec = 0;
567+ (void) ldap_set_option (ld, LDAP_OPT_NETWORK_TIMEOUT, &tv);
568+ debug3 ("LDAP set opt network timeout to %ld.0", tv.tv_sec);
569+#endif
501aed94 570+
3eddefd2
ER		 571+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_REFERRALS)
572+ (void) ldap_set_option (ld, LDAP_OPT_REFERRALS,
573+ options.referrals ? LDAP_OPT_ON : LDAP_OPT_OFF);
574+ debug3 ("LDAP set referrals to %d", options.referrals);
575+#endif
501aed94 576+
3eddefd2
ER		 577+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_RESTART)
578+ (void) ldap_set_option (ld, LDAP_OPT_RESTART,
579+ options.restart ? LDAP_OPT_ON : LDAP_OPT_OFF);
580+ debug3 ("LDAP set restart to %d", options.restart);
581+#endif
501aed94 582+
3eddefd2
ER		 583+#ifdef HAVE_LDAP_START_TLS_S
584+ if (options.ssl == SSL_START_TLS) {
585+ int version;
501aed94 586+
3eddefd2
ER		 587+ if (ldap_get_option (ld, LDAP_OPT_PROTOCOL_VERSION, &version)
588+ == LDAP_SUCCESS) {
589+ if (version < LDAP_VERSION3) {
590+ version = LDAP_VERSION3;
591+ (void) ldap_set_option (ld, LDAP_OPT_PROTOCOL_VERSION,
592+ &version);
593+ debug3 ("LDAP set version to %d", version);
594+ }
595+ }
501aed94 596+
3eddefd2
ER		 597+ if ((rc = ldap_start_tls_s (ld, NULL, NULL)) != LDAP_SUCCESS)
598+ fatal ("ldap_starttls_s: %s", ldap_err2string (rc));
599+ debug3 ("LDAP start TLS");
501aed94 600+ }
3eddefd2 601+#endif /* HAVE_LDAP_START_TLS_S */
501aed94
AM		 602+ }
603+
3eddefd2
ER		 604+ if ((msgid = ldap_simple_bind (ld, options.binddn,
605+ options.bindpw)) == -1) {
606+ ld_errno = ldap_get_lderrno (ld, 0, 0);
501aed94 607+
3eddefd2
ER		 608+ error ("ldap_simple_bind %s", ldap_err2string (ld_errno));
609+ reconnect++;
610+ goto retry;
611+ }
612+ debug3 ("LDAP simple bind (%s)", options.binddn);
501aed94 613+
3eddefd2
ER		 614+ timeout.tv_sec = options.bind_timelimit;
615+ timeout.tv_usec = 0;
616+ if ((rc = ldap_result (ld, msgid, FALSE, &timeout, &result)) < 1) {
617+ ld_errno = ldap_get_lderrno (ld, 0, 0);
501aed94 618+
3eddefd2
ER		 619+ error ("ldap_result %s", ldap_err2string (ld_errno));
620+ reconnect++;
621+ goto retry;
501aed94 622+ }
3eddefd2 623+ debug3 ("LDAP result in time");
501aed94 624+
3eddefd2
ER		 625+#if defined(HAVE_LDAP_PARSE_RESULT) && defined(HAVE_LDAP_CONTROLS_FREE)
626+ controls = NULL;
627+ if ((parserc = ldap_parse_result (ld, result, &rc, 0, 0, 0, &controls, TRUE)) != LDAP_SUCCESS)
628+ fatal ("ldap_parse_result %s", ldap_err2string (parserc));
629+ debug3 ("LDAP parse result OK");
501aed94 630+
3eddefd2
ER		 631+ if (controls != NULL) {
632+ ldap_controls_free (controls);
501aed94 633+ }
3eddefd2
ER		 634+#else
635+ rc = ldap_result2error (session->ld, result, TRUE);
636+#endif
637+ if (rc != LDAP_SUCCESS)
638+ fatal ("error trying to bind as user \"%s\" (%s)",
639+ options.binddn, ldap_err2string (rc));
501aed94 640+
3eddefd2 641+ debug2 ("LDAP do connect OK");
501aed94
AM		 642+}
643+
3eddefd2
ER		 644+void
645+process_user (const char *user, FILE *output)
646+{
647+ LDAPMessage *res, *e;
648+ char *buffer;
649+ int bufflen, rc, i;
650+ struct timeval timeout;
501aed94 651+
3eddefd2 652+ debug ("LDAP process user");
501aed94 653+
3eddefd2
ER		 654+ /* quick check for attempts to be evil */
655+ if ((strchr(user, '(') != NULL) || (strchr(user, ')') != NULL) ||
656+ (strchr(user, '*') != NULL) || (strchr(user, '\\') != NULL)) {
657+ logit ("illegal user name %s not processed", user);
658+ return;
659+ }
501aed94 660+
3eddefd2
ER		 661+ /* build filter for LDAP request */
662+ bufflen = strlen (LDAPSEARCH_FORMAT) + strlen(options.account_class) + strlen (user);
663+ if (options.ssh_filter != NULL)
664+ bufflen += strlen (options.ssh_filter);
665+ buffer = xmalloc (bufflen);
666+ snprintf(buffer, bufflen, LDAPSEARCH_FORMAT, options.account_class, user, (options.ssh_filter != NULL) ? options.ssh_filter : NULL);
667+ buffer[bufflen - 1] = 0;
501aed94 668+
3eddefd2 669+ debug3 ("LDAP search scope = %d %s", options.scope, buffer);
501aed94 670+
3eddefd2
ER		 671+ timeout.tv_sec = options.timelimit;
672+ timeout.tv_usec = 0;
673+ if ((rc = ldap_search_st(ld, options.base, options.scope, buffer, attrs, 0, &timeout, &res)) != LDAP_SUCCESS) {
674+ error ("ldap_search_st(): %s", ldap_err2string (rc));
675+ free (buffer);
676+ return;
677+ }
501aed94 678+
3eddefd2
ER		 679+ /* free */
680+ free (buffer);
501aed94 681+
3eddefd2
ER		 682+ for (e = ldap_first_entry(ld, res); e != NULL; e = ldap_next_entry(ld, e)) {
683+ int num;
684+ struct berval **keys;
501aed94 685+
3eddefd2
ER		 686+ keys = ldap_get_values_len(ld, e, PUBKEYATTR);
687+ num = ldap_count_values_len(keys);
688+ for (i = 0 ; i < num ; i++) {
689+ char *cp; //, *options = NULL;
501aed94 690+
3eddefd2
ER		 691+ for (cp = keys[i]->bv_val; *cp == ' ' || *cp == '\t'; cp++);
692+ if (!*cp || *cp == '\n' || *cp == '#')
693+ continue;
501aed94 694+
3eddefd2
ER		 695+ /* We have found the desired key. */
696+ fprintf (output, "%s\n", keys[i]->bv_val);
697+ }
501aed94 698+
3eddefd2
ER		 699+ ldap_value_free_len(keys);
700+ }
501aed94 701+
3eddefd2
ER		 702+ ldap_msgfree(res);
703+ debug2 ("LDAP process user finished");
704+}
501aed94 705+
3eddefd2
ER		 706+void
707+ldap_do_close(void)
708+{
709+ int rc;
501aed94 710+
3eddefd2
ER		 711+ debug ("LDAP do close");
712+ if ((rc = ldap_unbind_ext(ld, NULL, NULL)) != LDAP_SUCCESS)
713+ fatal ("ldap_unbind_ext: %s",
714+ ldap_err2string (rc));
501aed94 715+
3eddefd2
ER		 716+ ld = NULL;
717+ debug2 ("LDAP do close OK");
718+ return;
719+}
720+
721diff -up openssh-6.2p1/ldapbody.h.ldap openssh-6.2p1/ldapbody.h
722--- openssh-6.2p1/ldapbody.h.ldap 2013-03-25 21:27:15.889248078 +0100
723+++ openssh-6.2p1/ldapbody.h 2013-03-25 21:27:15.889248078 +0100
724@@ -0,0 +1,37 @@
725+/* $OpenBSD: ldapbody.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
501aed94
AM		 726+/*
727+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
728+ *
729+ * Redistribution and use in source and binary forms, with or without
730+ * modification, are permitted provided that the following conditions
731+ * are met:
732+ * 1. Redistributions of source code must retain the above copyright
733+ * notice, this list of conditions and the following disclaimer.
734+ * 2. Redistributions in binary form must reproduce the above copyright
735+ * notice, this list of conditions and the following disclaimer in the
736+ * documentation and/or other materials provided with the distribution.
737+ *
738+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
739+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
740+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
741+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
742+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
743+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
744+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
745+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
746+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
747+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
748+ */
749+
3eddefd2
ER		 750+#ifndef LDAPBODY_H
751+#define LDAPBODY_H
501aed94 752+
3eddefd2 753+#include <stdio.h>
501aed94 754+
3eddefd2
ER		 755+void ldap_checkconfig(void);
756+void ldap_do_connect(void);
757+void process_user(const char *, FILE *);
758+void ldap_do_close(void);
501aed94 759+
3eddefd2 760+#endif /* LDAPBODY_H */
501aed94 761+
3eddefd2
ER		 762diff -up openssh-6.2p2/ldapconf.c.ldap openssh-6.2p2/ldapconf.c
763--- openssh-6.2p2/ldapconf.c.ldap 2013-06-07 15:10:05.601942693 +0200
764+++ openssh-6.2p2/ldapconf.c 2013-06-07 15:10:24.928857566 +0200
765@@ -0,0 +1,691 @@
766+/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
767+/*
768+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
769+ *
770+ * Redistribution and use in source and binary forms, with or without
771+ * modification, are permitted provided that the following conditions
772+ * are met:
773+ * 1. Redistributions of source code must retain the above copyright
774+ * notice, this list of conditions and the following disclaimer.
775+ * 2. Redistributions in binary form must reproduce the above copyright
776+ * notice, this list of conditions and the following disclaimer in the
777+ * documentation and/or other materials provided with the distribution.
778+ *
779+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
780+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
781+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
782+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
783+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
784+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
785+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
786+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
787+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
788+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
789+ */
501aed94 790+
3eddefd2
ER		 791+#include "ldapincludes.h"
792+#include "ldap-helper.h"
793+#include "log.h"
794+#include "misc.h"
795+#include "xmalloc.h"
796+#include "ldapconf.h"
797+#include <unistd.h>
798+#include <string.h>
501aed94 799+
3eddefd2 800+/* Keyword tokens. */
501aed94 801+
3eddefd2
ER		 802+typedef enum {
803+ lBadOption,
804+ lHost, lURI, lBase, lBindDN, lBindPW, lRootBindDN,
805+ lScope, lDeref, lPort, lTimeLimit, lBind_TimeLimit,
806+ lLdap_Version, lBind_Policy, lSSLPath, lSSL, lReferrals,
807+ lRestart, lTLS_CheckPeer, lTLS_CaCertFile,
808+ lTLS_CaCertDir, lTLS_Ciphers, lTLS_Cert, lTLS_Key,
809+ lTLS_RandFile, lLogDir, lDebug, lSSH_Filter,
810+ lAccountClass, lDeprecated, lUnsupported
811+} OpCodes;
501aed94 812+
3eddefd2 813+/* Textual representations of the tokens. */
501aed94 814+
3eddefd2
ER		 815+static struct {
816+ const char *name;
817+ OpCodes opcode;
818+} keywords[] = {
819+ { "URI", lURI },
820+ { "Base", lBase },
821+ { "BindDN", lBindDN },
822+ { "BindPW", lBindPW },
823+ { "RootBindDN", lRootBindDN },
824+ { "Host", lHost },
825+ { "Port", lPort },
826+ { "Scope", lScope },
827+ { "Deref", lDeref },
828+ { "TimeLimit", lTimeLimit },
829+ { "TimeOut", lTimeLimit },
830+ { "Bind_Timelimit", lBind_TimeLimit },
831+ { "Network_TimeOut", lBind_TimeLimit },
832+/*
833+ * Todo
834+ * SIZELIMIT
835+ */
836+ { "Ldap_Version", lLdap_Version },
837+ { "Version", lLdap_Version },
838+ { "Bind_Policy", lBind_Policy },
839+ { "SSLPath", lSSLPath },
840+ { "SSL", lSSL },
841+ { "Referrals", lReferrals },
842+ { "Restart", lRestart },
843+ { "TLS_CheckPeer", lTLS_CheckPeer },
844+ { "TLS_ReqCert", lTLS_CheckPeer },
845+ { "TLS_CaCertFile", lTLS_CaCertFile },
846+ { "TLS_CaCert", lTLS_CaCertFile },
847+ { "TLS_CaCertDir", lTLS_CaCertDir },
848+ { "TLS_Ciphers", lTLS_Ciphers },
849+ { "TLS_Cipher_Suite", lTLS_Ciphers },
850+ { "TLS_Cert", lTLS_Cert },
851+ { "TLS_Certificate", lTLS_Cert },
852+ { "TLS_Key", lTLS_Key },
853+ { "TLS_RandFile", lTLS_RandFile },
854+/*
855+ * Todo
856+ * TLS_CRLCHECK
857+ * TLS_CRLFILE
858+ */
859+ { "LogDir", lLogDir },
860+ { "Debug", lDebug },
861+ { "SSH_Filter", lSSH_Filter },
862+ { "AccountClass", lAccountClass },
863+ { NULL, lBadOption }
864+};
501aed94 865+
3eddefd2 866+/* Configuration ptions. */
501aed94 867+
3eddefd2 868+Options options;
501aed94 869+
3eddefd2
ER		 870+/*
871+ * Returns the number of the token pointed to by cp or oBadOption.
872+ */
501aed94 873+
3eddefd2
ER		 874+static OpCodes
875+parse_token(const char *cp, const char *filename, int linenum)
876+{
877+ u_int i;
501aed94 878+
3eddefd2
ER		 879+ for (i = 0; keywords[i].name; i++)
880+ if (strcasecmp(cp, keywords[i].name) == 0)
881+ return keywords[i].opcode;
501aed94 882+
3eddefd2
ER		 883+ if (config_warning_config_file)
884+ logit("%s: line %d: Bad configuration option: %s",
885+ filename, linenum, cp);
886+ return lBadOption;
887+}
501aed94 888+
3eddefd2
ER		 889+/*
890+ * Processes a single option line as used in the configuration files. This
891+ * only sets those values that have not already been set.
892+ */
893+#define WHITESPACE " \t\r\n"
501aed94 894+
3eddefd2
ER		 895+static int
896+process_config_line(char *line, const char *filename, int linenum)
897+{
898+ char *s, **charptr, **xstringptr, *endofnumber, *keyword, *arg;
899+ char *rootbinddn = NULL;
900+ int opcode, *intptr, value;
901+ size_t len;
501aed94 902+
3eddefd2
ER		 903+ /* Strip trailing whitespace */
904+ for (len = strlen(line) - 1; len > 0; len--) {
905+ if (strchr(WHITESPACE, line[len]) == NULL)
906+ break;
907+ line[len] = '\0';
908+ }
909+
910+ s = line;
911+ /* Get the keyword. (Each line is supposed to begin with a keyword). */
912+ if ((keyword = strdelim(&s)) == NULL)
913+ return 0;
914+ /* Ignore leading whitespace. */
915+ if (*keyword == '\0')
916+ keyword = strdelim(&s);
917+ if (keyword == NULL || !*keyword || *keyword == '\n' || *keyword == '#')
918+ return 0;
501aed94 919+
3eddefd2 920+ opcode = parse_token(keyword, filename, linenum);
501aed94 921+
3eddefd2
ER		 922+ switch (opcode) {
923+ case lBadOption:
924+ /* don't panic, but count bad options */
925+ return -1;
926+ /* NOTREACHED */
501aed94 927+
3eddefd2
ER		 928+ case lHost:
929+ xstringptr = &options.host;
930+parse_xstring:
931+ if (!s || *s == '\0')
932+ fatal("%s line %d: missing dn",filename,linenum);
933+ if (*xstringptr == NULL)
934+ *xstringptr = xstrdup(s);
935+ return 0;
501aed94 936+
3eddefd2
ER		 937+ case lURI:
938+ xstringptr = &options.uri;
939+ goto parse_xstring;
501aed94 940+
3eddefd2
ER		 941+ case lBase:
942+ xstringptr = &options.base;
943+ goto parse_xstring;
501aed94 944+
3eddefd2
ER		 945+ case lBindDN:
946+ xstringptr = &options.binddn;
947+ goto parse_xstring;
501aed94 948+
3eddefd2
ER		 949+ case lBindPW:
950+ charptr = &options.bindpw;
951+parse_string:
952+ arg = strdelim(&s);
953+ if (!arg || *arg == '\0')
954+ fatal("%.200s line %d: Missing argument.", filename, linenum);
955+ if (*charptr == NULL)
956+ *charptr = xstrdup(arg);
957+ break;
501aed94 958+
3eddefd2
ER		 959+ case lRootBindDN:
960+ xstringptr = &rootbinddn;
961+ goto parse_xstring;
501aed94 962+
3eddefd2
ER		 963+ case lScope:
964+ intptr = &options.scope;
965+ arg = strdelim(&s);
966+ if (!arg || *arg == '\0')
967+ fatal("%.200s line %d: Missing sub/one/base argument.", filename, linenum);
968+ value = 0; /* To avoid compiler warning... */
969+ if (strcasecmp (arg, "sub") == 0 || strcasecmp (arg, "subtree") == 0)
970+ value = LDAP_SCOPE_SUBTREE;
971+ else if (strcasecmp (arg, "one") == 0)
972+ value = LDAP_SCOPE_ONELEVEL;
973+ else if (strcasecmp (arg, "base") == 0)
974+ value = LDAP_SCOPE_BASE;
975+ else
976+ fatal("%.200s line %d: Bad sub/one/base argument.", filename, linenum);
977+ if (*intptr == -1)
978+ *intptr = value;
979+ break;
501aed94 980+
3eddefd2
ER		 981+ case lDeref:
982+ intptr = &options.scope;
983+ arg = strdelim(&s);
984+ if (!arg || *arg == '\0')
985+ fatal("%.200s line %d: Missing never/searching/finding/always argument.", filename, linenum);
986+ value = 0; /* To avoid compiler warning... */
987+ if (!strcasecmp (arg, "never"))
988+ value = LDAP_DEREF_NEVER;
989+ else if (!strcasecmp (arg, "searching"))
990+ value = LDAP_DEREF_SEARCHING;
991+ else if (!strcasecmp (arg, "finding"))
992+ value = LDAP_DEREF_FINDING;
993+ else if (!strcasecmp (arg, "always"))
994+ value = LDAP_DEREF_ALWAYS;
995+ else
996+ fatal("%.200s line %d: Bad never/searching/finding/always argument.", filename, linenum);
997+ if (*intptr == -1)
998+ *intptr = value;
999+ break;
501aed94 1000+
3eddefd2
ER		 1001+ case lPort:
1002+ intptr = &options.port;
1003+parse_int:
1004+ arg = strdelim(&s);
1005+ if (!arg || *arg == '\0')
1006+ fatal("%.200s line %d: Missing argument.", filename, linenum);
1007+ if (arg[0] < '0' || arg[0] > '9')
1008+ fatal("%.200s line %d: Bad number.", filename, linenum);
501aed94 1009+
3eddefd2
ER		 1010+ /* Octal, decimal, or hex format? */
1011+ value = strtol(arg, &endofnumber, 0);
1012+ if (arg == endofnumber)
1013+ fatal("%.200s line %d: Bad number.", filename, linenum);
1014+ if (*intptr == -1)
1015+ *intptr = value;
1016+ break;
501aed94 1017+
3eddefd2
ER		 1018+ case lTimeLimit:
1019+ intptr = &options.timelimit;
1020+parse_time:
1021+ arg = strdelim(&s);
1022+ if (!arg || *arg == '\0')
1023+ fatal("%s line %d: missing time value.",
1024+ filename, linenum);
1025+ if ((value = convtime(arg)) == -1)
1026+ fatal("%s line %d: invalid time value.",
1027+ filename, linenum);
1028+ if (*intptr == -1)
1029+ *intptr = value;
1030+ break;
501aed94 1031+
3eddefd2
ER		 1032+ case lBind_TimeLimit:
1033+ intptr = &options.bind_timelimit;
1034+ goto parse_time;
501aed94 1035+
3eddefd2
ER		 1036+ case lLdap_Version:
1037+ intptr = &options.ldap_version;
1038+ goto parse_int;
501aed94 1039+
3eddefd2
ER		 1040+ case lBind_Policy:
1041+ intptr = &options.bind_policy;
1042+ arg = strdelim(&s);
1043+ if (!arg || *arg == '\0')
1044+ fatal("%.200s line %d: Missing soft/hard argument.", filename, linenum);
1045+ value = 0; /* To avoid compiler warning... */
1046+ if (strcasecmp(arg, "hard") == 0 || strcasecmp(arg, "hard_open") == 0 || strcasecmp(arg, "hard_init") == 0)
1047+ value = 1;
1048+ else if (strcasecmp(arg, "soft") == 0)
1049+ value = 0;
1050+ else
1051+ fatal("%.200s line %d: Bad soft/hard argument.", filename, linenum);
1052+ if (*intptr == -1)
1053+ break;
501aed94 1054+
3eddefd2
ER		 1055+ case lSSLPath:
1056+ charptr = &options.sslpath;
1057+ goto parse_string;
501aed94 1058+
3eddefd2
ER		 1059+ case lSSL:
1060+ intptr = &options.ssl;
1061+ arg = strdelim(&s);
1062+ if (!arg || *arg == '\0')
1063+ fatal("%.200s line %d: Missing yes/no/start_tls argument.", filename, linenum);
1064+ value = 0; /* To avoid compiler warning... */
1065+ if (strcasecmp(arg, "yes") == 0 || strcasecmp(arg, "true") == 0 || strcasecmp(arg, "on") == 0)
1066+ value = SSL_LDAPS;
1067+ else if (strcasecmp(arg, "no") == 0 || strcasecmp(arg, "false") == 0 || strcasecmp(arg, "off") == 0)
1068+ value = SSL_OFF;
1069+ else if (!strcasecmp (arg, "start_tls"))
1070+ value = SSL_START_TLS;
1071+ else
1072+ fatal("%.200s line %d: Bad yes/no/start_tls argument.", filename, linenum);
1073+ if (*intptr == -1)
1074+ *intptr = value;
1075+ break;
501aed94 1076+
3eddefd2
ER		 1077+ case lReferrals:
1078+ intptr = &options.referrals;
1079+parse_flag:
1080+ arg = strdelim(&s);
1081+ if (!arg || *arg == '\0')
1082+ fatal("%.200s line %d: Missing yes/no argument.", filename, linenum);
1083+ value = 0; /* To avoid compiler warning... */
1084+ if (strcasecmp(arg, "yes") == 0 || strcasecmp(arg, "true") == 0 || strcasecmp(arg, "on") == 0)
1085+ value = 1;
1086+ else if (strcasecmp(arg, "no") == 0 || strcasecmp(arg, "false") == 0 || strcasecmp(arg, "off") == 0)
1087+ value = 0;
1088+ else
1089+ fatal("%.200s line %d: Bad yes/no argument.", filename, linenum);
1090+ if (*intptr == -1)
1091+ *intptr = value;
1092+ break;
1093+
1094+ case lRestart:
1095+ intptr = &options.restart;
1096+ goto parse_flag;
501aed94 1097+
3eddefd2
ER		 1098+ case lTLS_CheckPeer:
1099+ intptr = &options.tls_checkpeer;
1100+ arg = strdelim(&s);
1101+ if (!arg || *arg == '\0')
1102+ fatal("%.200s line %d: Missing never/hard/demand/alow/try argument.", filename, linenum);
1103+ value = 0; /* To avoid compiler warning... */
1104+ if (strcasecmp(arg, "never") == 0 || strcasecmp(arg, "no") == 0 || strcasecmp(arg, "false") == 0 || strcasecmp(arg, "off") == 0)
1105+ value = LDAP_OPT_X_TLS_NEVER;
1106+ else if (strcasecmp(arg, "hard") == 0 || strcasecmp(arg, "yes") == 0 || strcasecmp(arg, "true") == 0 || strcasecmp(arg, "on") == 0)
1107+ value = LDAP_OPT_X_TLS_HARD;
1108+ else if (strcasecmp(arg, "demand") == 0)
1109+ value = LDAP_OPT_X_TLS_DEMAND;
1110+ else if (strcasecmp(arg, "allow") == 0)
1111+ value = LDAP_OPT_X_TLS_ALLOW;
1112+ else if (strcasecmp(arg, "try") == 0)
1113+ value = LDAP_OPT_X_TLS_TRY;
1114+ else
1115+ fatal("%.200s line %d: Bad never/hard/demand/alow/try argument.", filename, linenum);
1116+ if (*intptr == -1)
1117+ break;
501aed94 1118+
3eddefd2
ER		 1119+ case lTLS_CaCertFile:
1120+ charptr = &options.tls_cacertfile;
1121+ goto parse_string;
501aed94 1122+
3eddefd2
ER		 1123+ case lTLS_CaCertDir:
1124+ charptr = &options.tls_cacertdir;
1125+ goto parse_string;
501aed94 1126+
3eddefd2
ER		 1127+ case lTLS_Ciphers:
1128+ xstringptr = &options.tls_ciphers;
1129+ goto parse_xstring;
501aed94 1130+
3eddefd2
ER		 1131+ case lTLS_Cert:
1132+ charptr = &options.tls_cert;
1133+ goto parse_string;
501aed94 1134+
3eddefd2
ER		 1135+ case lTLS_Key:
1136+ charptr = &options.tls_key;
1137+ goto parse_string;
501aed94 1138+
3eddefd2
ER		 1139+ case lTLS_RandFile:
1140+ charptr = &options.tls_randfile;
1141+ goto parse_string;
501aed94 1142+
3eddefd2
ER		 1143+ case lLogDir:
1144+ charptr = &options.logdir;
1145+ goto parse_string;
501aed94 1146+
3eddefd2
ER		 1147+ case lDebug:
1148+ intptr = &options.debug;
1149+ goto parse_int;
501aed94 1150+
3eddefd2
ER		 1151+ case lSSH_Filter:
1152+ xstringptr = &options.ssh_filter;
1153+ goto parse_xstring;
501aed94 1154+
3eddefd2
ER		 1155+ case lAccountClass:
1156+ charptr = &options.account_class;
1157+ goto parse_string;
501aed94 1158+
3eddefd2
ER		 1159+ case lDeprecated:
1160+ debug("%s line %d: Deprecated option \"%s\"",
1161+ filename, linenum, keyword);
1162+ return 0;
501aed94 1163+
3eddefd2
ER		 1164+ case lUnsupported:
1165+ error("%s line %d: Unsupported option \"%s\"",
1166+ filename, linenum, keyword);
1167+ return 0;
501aed94 1168+
3eddefd2
ER		 1169+ default:
1170+ fatal("process_config_line: Unimplemented opcode %d", opcode);
1171+ }
501aed94 1172+
3eddefd2
ER		 1173+ /* Check that there is no garbage at end of line. */
1174+ if ((arg = strdelim(&s)) != NULL && *arg != '\0') {
1175+ fatal("%.200s line %d: garbage at end of line; \"%.200s\".",
1176+ filename, linenum, arg);
1177+ }
1178+ return 0;
1179+}
501aed94 1180+
501aed94 1181+/*
3eddefd2
ER		 1182+ * Reads the config file and modifies the options accordingly. Options
1183+ * should already be initialized before this call. This never returns if
1184+ * there is an error. If the file does not exist, this returns 0.
501aed94
AM		 1185+ */
1186+
3eddefd2
ER		 1187+void
1188+read_config_file(const char *filename)
1189+{
1190+ FILE *f;
1191+ char line[1024];
1192+ int active, linenum;
1193+ int bad_options = 0;
1194+ struct stat sb;
501aed94 1195+
3eddefd2
ER		 1196+ if ((f = fopen(filename, "r")) == NULL)
1197+ fatal("fopen %s: %s", filename, strerror(errno));
501aed94 1198+
3eddefd2
ER		 1199+ if (fstat(fileno(f), &sb) == -1)
1200+ fatal("fstat %s: %s", filename, strerror(errno));
1201+ if (((sb.st_uid != 0 && sb.st_uid != getuid()) ||
1202+ (sb.st_mode & 022) != 0))
1203+ fatal("Bad owner or permissions on %s", filename);
501aed94 1204+
3eddefd2 1205+ debug("Reading configuration data %.200s", filename);
501aed94 1206+
3eddefd2
ER		 1207+ /*
1208+ * Mark that we are now processing the options. This flag is turned
1209+ * on/off by Host specifications.
1210+ */
1211+ active = 1;
1212+ linenum = 0;
1213+ while (fgets(line, sizeof(line), f)) {
1214+ /* Update line number counter. */
1215+ linenum++;
1216+ if (process_config_line(line, filename, linenum) != 0)
1217+ bad_options++;
1218+ }
1219+ fclose(f);
1220+ if ((bad_options > 0) && config_exclusive_config_file)
1221+ fatal("%s: terminating, %d bad configuration options",
1222+ filename, bad_options);
1223+}
501aed94
AM		 1224+
1225+/*
3eddefd2
ER		 1226+ * Initializes options to special values that indicate that they have not yet
1227+ * been set. Read_config_file will only set options with this value. Options
1228+ * are processed in the following order: command line, user config file,
1229+ * system config file. Last, fill_default_options is called.
501aed94
AM		 1230+ */
1231+
3eddefd2
ER		 1232+void
1233+initialize_options(void)
501aed94 1234+{
3eddefd2
ER		 1235+ memset(&options, 'X', sizeof(options));
1236+ options.host = NULL;
1237+ options.uri = NULL;
1238+ options.base = NULL;
1239+ options.binddn = NULL;
1240+ options.bindpw = NULL;
1241+ options.scope = -1;
1242+ options.deref = -1;
1243+ options.port = -1;
1244+ options.timelimit = -1;
1245+ options.bind_timelimit = -1;
1246+ options.ldap_version = -1;
1247+ options.bind_policy = -1;
1248+ options.sslpath = NULL;
1249+ options.ssl = -1;
1250+ options.referrals = -1;
1251+ options.restart = -1;
1252+ options.tls_checkpeer = -1;
1253+ options.tls_cacertfile = NULL;
1254+ options.tls_cacertdir = NULL;
1255+ options.tls_ciphers = NULL;
1256+ options.tls_cert = NULL;
1257+ options.tls_key = NULL;
1258+ options.tls_randfile = NULL;
1259+ options.logdir = NULL;
1260+ options.debug = -1;
1261+ options.ssh_filter = NULL;
1262+ options.account_class = NULL;
501aed94
AM		 1263+}
1264+
1265+/*
3eddefd2
ER		 1266+ * Called after processing other sources of option data, this fills those
1267+ * options for which no value has been specified with their default values.
501aed94 1268+ */
501aed94 1269+
3eddefd2
ER		 1270+void
1271+fill_default_options(void)
501aed94 1272+{
3eddefd2
ER		 1273+ if (options.uri != NULL) {
1274+ LDAPURLDesc *ludp;
501aed94 1275+
3eddefd2
ER		 1276+ if (ldap_url_parse(options.uri, &ludp) == LDAP_SUCCESS) {
1277+ if (options.ssl == -1) {
1278+ if (strcmp (ludp->lud_scheme, "ldap") == 0)
1279+ options.ssl = 2;
1280+ if (strcmp (ludp->lud_scheme, "ldapi") == 0)
1281+ options.ssl = 0;
1282+ else if (strcmp (ludp->lud_scheme, "ldaps") == 0)
1283+ options.ssl = 1;
1284+ }
1285+ if (options.host == NULL)
1286+ options.host = xstrdup (ludp->lud_host);
1287+ if (options.port == -1)
1288+ options.port = ludp->lud_port;
501aed94 1289+
3eddefd2
ER		 1290+ ldap_free_urldesc (ludp);
1291+ }
1292+ }
1293+ if (options.ssl == -1)
1294+ options.ssl = SSL_START_TLS;
1295+ if (options.port == -1)
1296+ options.port = (options.ssl == 0) ? 389 : 636;
1297+ if (options.uri == NULL) {
1298+ int len;
1299+#define MAXURILEN 4096
501aed94 1300+
3eddefd2
ER		 1301+ options.uri = xmalloc (MAXURILEN);
1302+ len = snprintf (options.uri, MAXURILEN, "ldap%s://%s:%d",
1303+ (options.ssl == 0) ? "" : "s", options.host, options.port);
1304+ options.uri[MAXURILEN - 1] = 0;
4c64cbae 1305+ options.uri = xreallocarray (options.uri, len + 1, 1);
3eddefd2
ER		 1306+ }
1307+ if (options.binddn == NULL)
1308+ options.binddn = "";
1309+ if (options.bindpw == NULL)
1310+ options.bindpw = "";
1311+ if (options.scope == -1)
1312+ options.scope = LDAP_SCOPE_SUBTREE;
1313+ if (options.deref == -1)
1314+ options.deref = LDAP_DEREF_NEVER;
1315+ if (options.timelimit == -1)
1316+ options.timelimit = 10;
1317+ if (options.bind_timelimit == -1)
1318+ options.bind_timelimit = 10;
1319+ if (options.ldap_version == -1)
1320+ options.ldap_version = 3;
1321+ if (options.bind_policy == -1)
1322+ options.bind_policy = 1;
1323+ if (options.referrals == -1)
1324+ options.referrals = 1;
1325+ if (options.restart == -1)
1326+ options.restart = 1;
1327+ if (options.tls_checkpeer == -1)
1328+ options.tls_checkpeer = LDAP_OPT_X_TLS_HARD;
1329+ if (options.debug == -1)
1330+ options.debug = 0;
1331+ if (options.ssh_filter == NULL)
1332+ options.ssh_filter = "";
1333+ if (options.account_class == NULL)
1334+ options.account_class = "posixAccount";
1335+}
501aed94 1336+
3eddefd2
ER		 1337+static const char *
1338+lookup_opcode_name(OpCodes code)
1339+{
1340+ u_int i;
501aed94 1341+
3eddefd2
ER		 1342+ for (i = 0; keywords[i].name != NULL; i++)
1343+ if (keywords[i].opcode == code)
1344+ return(keywords[i].name);
1345+ return "UNKNOWN";
1346+}
501aed94 1347+
3eddefd2
ER		 1348+static void
1349+dump_cfg_string(OpCodes code, const char *val)
1350+{
1351+ if (val == NULL)
1352+ debug3("%s <UNDEFINED>", lookup_opcode_name(code));
1353+ else
1354+ debug3("%s %s", lookup_opcode_name(code), val);
1355+}
501aed94 1356+
3eddefd2
ER		 1357+static void
1358+dump_cfg_int(OpCodes code, int val)
1359+{
1360+ if (val == -1)
1361+ debug3("%s <UNDEFINED>", lookup_opcode_name(code));
1362+ else
1363+ debug3("%s %d", lookup_opcode_name(code), val);
1364+}
501aed94 1365+
3eddefd2
ER		 1366+struct names {
1367+ int value;
1368+ char *name;
1369+};
501aed94 1370+
3eddefd2
ER		 1371+static void
1372+dump_cfg_namedint(OpCodes code, int val, struct names *names)
1373+{
1374+ u_int i;
501aed94 1375+
3eddefd2
ER		 1376+ if (val == -1)
1377+ debug3("%s <UNDEFINED>", lookup_opcode_name(code));
1378+ else {
1379+ for (i = 0; names[i].value != -1; i++)
1380+ if (names[i].value == val) {
1381+ debug3("%s %s", lookup_opcode_name(code), names[i].name);
1382+ return;
1383+ }
1384+ debug3("%s unknown: %d", lookup_opcode_name(code), val);
1385+ }
1386+}
501aed94 1387+
3eddefd2
ER		 1388+static struct names _yesnotls[] = {
1389+ { 0, "No" },
1390+ { 1, "Yes" },
1391+ { 2, "Start_TLS" },
1392+ { -1, NULL }};
501aed94 1393+
3eddefd2
ER		 1394+static struct names _scope[] = {
1395+ { LDAP_SCOPE_BASE, "Base" },
1396+ { LDAP_SCOPE_ONELEVEL, "One" },
1397+ { LDAP_SCOPE_SUBTREE, "Sub"},
1398+ { -1, NULL }};
501aed94 1399+
3eddefd2
ER		 1400+static struct names _deref[] = {
1401+ { LDAP_DEREF_NEVER, "Never" },
1402+ { LDAP_DEREF_SEARCHING, "Searching" },
1403+ { LDAP_DEREF_FINDING, "Finding" },
1404+ { LDAP_DEREF_ALWAYS, "Always" },
1405+ { -1, NULL }};
501aed94 1406+
3eddefd2
ER		 1407+static struct names _yesno[] = {
1408+ { 0, "No" },
1409+ { 1, "Yes" },
1410+ { -1, NULL }};
501aed94 1411+
3eddefd2
ER		 1412+static struct names _bindpolicy[] = {
1413+ { 0, "Soft" },
1414+ { 1, "Hard" },
1415+ { -1, NULL }};
501aed94 1416+
3eddefd2
ER		 1417+static struct names _checkpeer[] = {
1418+ { LDAP_OPT_X_TLS_NEVER, "Never" },
1419+ { LDAP_OPT_X_TLS_HARD, "Hard" },
1420+ { LDAP_OPT_X_TLS_DEMAND, "Demand" },
1421+ { LDAP_OPT_X_TLS_ALLOW, "Allow" },
1422+ { LDAP_OPT_X_TLS_TRY, "TRY" },
1423+ { -1, NULL }};
501aed94 1424+
3eddefd2
ER		 1425+void
1426+dump_config(void)
1427+{
1428+ dump_cfg_string(lURI, options.uri);
1429+ dump_cfg_string(lHost, options.host);
1430+ dump_cfg_int(lPort, options.port);
1431+ dump_cfg_namedint(lSSL, options.ssl, _yesnotls);
1432+ dump_cfg_int(lLdap_Version, options.ldap_version);
1433+ dump_cfg_int(lTimeLimit, options.timelimit);
1434+ dump_cfg_int(lBind_TimeLimit, options.bind_timelimit);
1435+ dump_cfg_string(lBase, options.base);
1436+ dump_cfg_string(lBindDN, options.binddn);
1437+ dump_cfg_string(lBindPW, options.bindpw);
1438+ dump_cfg_namedint(lScope, options.scope, _scope);
1439+ dump_cfg_namedint(lDeref, options.deref, _deref);
1440+ dump_cfg_namedint(lReferrals, options.referrals, _yesno);
1441+ dump_cfg_namedint(lRestart, options.restart, _yesno);
1442+ dump_cfg_namedint(lBind_Policy, options.bind_policy, _bindpolicy);
1443+ dump_cfg_string(lSSLPath, options.sslpath);
1444+ dump_cfg_namedint(lTLS_CheckPeer, options.tls_checkpeer, _checkpeer);
1445+ dump_cfg_string(lTLS_CaCertFile, options.tls_cacertfile);
1446+ dump_cfg_string(lTLS_CaCertDir, options.tls_cacertdir);
1447+ dump_cfg_string(lTLS_Ciphers, options.tls_ciphers);
1448+ dump_cfg_string(lTLS_Cert, options.tls_cert);
1449+ dump_cfg_string(lTLS_Key, options.tls_key);
1450+ dump_cfg_string(lTLS_RandFile, options.tls_randfile);
1451+ dump_cfg_string(lLogDir, options.logdir);
1452+ dump_cfg_int(lDebug, options.debug);
1453+ dump_cfg_string(lSSH_Filter, options.ssh_filter);
1454+ dump_cfg_string(lAccountClass, options.logdir);
1455+}
501aed94 1456+
3eddefd2
ER		 1457diff -up openssh-6.2p2/ldapconf.h.ldap openssh-6.2p2/ldapconf.h
1458--- openssh-6.2p2/ldapconf.h.ldap 2013-06-07 15:10:05.602942689 +0200
1459+++ openssh-6.2p2/ldapconf.h 2013-06-07 15:10:24.928857566 +0200
1460@@ -0,0 +1,72 @@
1461+/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
1462+/*
1463+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
1464+ *
1465+ * Redistribution and use in source and binary forms, with or without
1466+ * modification, are permitted provided that the following conditions
1467+ * are met:
1468+ * 1. Redistributions of source code must retain the above copyright
1469+ * notice, this list of conditions and the following disclaimer.
1470+ * 2. Redistributions in binary form must reproduce the above copyright
1471+ * notice, this list of conditions and the following disclaimer in the
1472+ * documentation and/or other materials provided with the distribution.
1473+ *
1474+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
1475+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
1476+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
1477+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
1478+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
1479+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
1480+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
1481+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
1482+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
1483+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1484+ */
501aed94 1485+
3eddefd2
ER		 1486+#ifndef LDAPCONF_H
1487+#define LDAPCONF_H
501aed94 1488+
3eddefd2
ER		 1489+#define SSL_OFF 0
1490+#define SSL_LDAPS 1
1491+#define SSL_START_TLS 2
501aed94 1492+
3eddefd2 1493+/* Data structure for representing option data. */
501aed94 1494+
3eddefd2
ER		 1495+typedef struct {
1496+ char *host;
1497+ char *uri;
1498+ char *base;
1499+ char *binddn;
1500+ char *bindpw;
1501+ int scope;
1502+ int deref;
1503+ int port;
1504+ int timelimit;
1505+ int bind_timelimit;
1506+ int ldap_version;
1507+ int bind_policy;
1508+ char *sslpath;
1509+ int ssl;
1510+ int referrals;
1511+ int restart;
1512+ int tls_checkpeer;
1513+ char *tls_cacertfile;
1514+ char *tls_cacertdir;
1515+ char *tls_ciphers;
1516+ char *tls_cert;
1517+ char *tls_key;
1518+ char *tls_randfile;
1519+ char *logdir;
1520+ int debug;
1521+ char *ssh_filter;
1522+ char *account_class;
1523+} Options;
501aed94 1524+
3eddefd2 1525+extern Options options;
501aed94 1526+
3eddefd2
ER		 1527+void read_config_file(const char *);
1528+void initialize_options(void);
1529+void fill_default_options(void);
1530+void dump_config(void);
501aed94 1531+
3eddefd2
ER		 1532+#endif /* LDAPCONF_H */
1533diff -up openssh-6.2p1/ldap.conf.ldap openssh-6.2p1/ldap.conf
1534--- openssh-6.2p1/ldap.conf.ldap 2013-03-25 21:27:15.891248091 +0100
1535+++ openssh-6.2p1/ldap.conf 2013-03-25 21:27:15.891248091 +0100
1536@@ -0,0 +1,88 @@
1537+# $Id: openssh-5.5p1-ldap.patch,v 1.3 2010/07/07 13:48:36 jfch2222 Exp $
1538+#
1539+# This is the example configuration file for the OpenSSH
1540+# LDAP backend
1541+#
1542+# see ssh-ldap.conf(5)
1543+#
501aed94 1544+
3eddefd2
ER		 1545+# URI with your LDAP server name. This allows to use
1546+# Unix Domain Sockets to connect to a local LDAP Server.
1547+#uri ldap://127.0.0.1/
1548+#uri ldaps://127.0.0.1/
1549+#uri ldapi://%2fvar%2frun%2fldapi_sock/
1550+# Note: %2f encodes the '/' used as directory separator
501aed94 1551+
3eddefd2
ER		 1552+# Another way to specify your LDAP server is to provide an
1553+# host name and the port of our LDAP server. Host name
1554+# must be resolvable without using LDAP.
1555+# Multiple hosts may be specified, each separated by a
1556+# space. How long nss_ldap takes to failover depends on
1557+# whether your LDAP client library supports configurable
1558+# network or connect timeouts (see bind_timelimit).
1559+#host 127.0.0.1
501aed94 1560+
3eddefd2
ER		 1561+# The port.
1562+# Optional: default is 389.
1563+#port 389
501aed94 1564+
3eddefd2
ER		 1565+# The distinguished name to bind to the server with.
1566+# Optional: default is to bind anonymously.
1567+#binddn cn=openssh_keys,dc=example,dc=org
501aed94 1568+
3eddefd2
ER		 1569+# The credentials to bind with.
1570+# Optional: default is no credential.
1571+#bindpw TopSecret
501aed94 1572+
3eddefd2
ER		 1573+# The distinguished name of the search base.
1574+#base dc=example,dc=org
501aed94 1575+
3eddefd2
ER		 1576+# The LDAP version to use (defaults to 3
1577+# if supported by client library)
1578+#ldap_version 3
501aed94 1579+
3eddefd2
ER		 1580+# The search scope.
1581+#scope sub
1582+#scope one
1583+#scope base
501aed94 1584+
3eddefd2
ER		 1585+# Search timelimit
1586+#timelimit 30
501aed94 1587+
3eddefd2
ER		 1588+# Bind/connect timelimit
1589+#bind_timelimit 30
501aed94 1590+
3eddefd2
ER		 1591+# Reconnect policy: hard (default) will retry connecting to
1592+# the software with exponential backoff, soft will fail
1593+# immediately.
1594+#bind_policy hard
501aed94 1595+
3eddefd2
ER		 1596+# SSL setup, may be implied by URI also.
1597+#ssl no
1598+#ssl on
1599+#ssl start_tls
501aed94 1600+
3eddefd2
ER		 1601+# OpenLDAP SSL options
1602+# Require and verify server certificate (yes/no)
1603+# Default is to use libldap's default behavior, which can be configured in
1604+# /etc/openldap/ldap.conf using the TLS_REQCERT setting. The default for
1605+# OpenLDAP 2.0 and earlier is "no", for 2.1 and later is "yes".
1606+#tls_checkpeer hard
501aed94 1607+
3eddefd2
ER		 1608+# CA certificates for server certificate verification
1609+# At least one of these are required if tls_checkpeer is "yes"
1610+#tls_cacertfile /etc/ssl/ca.cert
1611+#tls_cacertdir /etc/pki/tls/certs
501aed94 1612+
3eddefd2
ER		 1613+# Seed the PRNG if /dev/urandom is not provided
1614+#tls_randfile /var/run/egd-pool
501aed94 1615+
3eddefd2
ER		 1616+# SSL cipher suite
1617+# See man ciphers for syntax
1618+#tls_ciphers TLSv1
501aed94 1619+
3eddefd2
ER		 1620+# Client certificate and key
1621+# Use these, if your server requires client authentication.
1622+#tls_cert
1623+#tls_key
501aed94 1624+
3eddefd2
ER		 1625diff -up openssh-6.2p1/ldap-helper.c.ldap openssh-6.2p1/ldap-helper.c
1626--- openssh-6.2p1/ldap-helper.c.ldap 2013-03-25 21:27:15.892248097 +0100
1627+++ openssh-6.2p1/ldap-helper.c 2013-03-25 21:27:15.892248097 +0100
1628@@ -0,0 +1,155 @@
1629+/* $OpenBSD: ssh-pka-ldap.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
501aed94 1630+/*
3eddefd2
ER		 1631+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
1632+ *
1633+ * Redistribution and use in source and binary forms, with or without
1634+ * modification, are permitted provided that the following conditions
1635+ * are met:
1636+ * 1. Redistributions of source code must retain the above copyright
1637+ * notice, this list of conditions and the following disclaimer.
1638+ * 2. Redistributions in binary form must reproduce the above copyright
1639+ * notice, this list of conditions and the following disclaimer in the
1640+ * documentation and/or other materials provided with the distribution.
1641+ *
1642+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
1643+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
1644+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
1645+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
1646+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
1647+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
1648+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
1649+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
1650+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
1651+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
501aed94
AM		 1652+ */
1653+
3eddefd2
ER		 1654+#include "ldapincludes.h"
1655+#include "log.h"
1656+#include "misc.h"
1657+#include "xmalloc.h"
1658+#include "ldapconf.h"
1659+#include "ldapbody.h"
1660+#include <string.h>
1661+#include <unistd.h>
501aed94 1662+
3eddefd2
ER		 1663+static int config_debug = 0;
1664+int config_exclusive_config_file = 0;
1665+static char *config_file_name = "/etc/ssh/ldap.conf";
1666+static char *config_single_user = NULL;
1667+static int config_verbose = SYSLOG_LEVEL_VERBOSE;
1668+int config_warning_config_file = 0;
1669+extern char *__progname;
501aed94
AM		 1670+
1671+static void
3eddefd2 1672+usage(void)
501aed94 1673+{
3eddefd2
ER		 1674+ fprintf(stderr, "usage: %s [options]\n",
1675+ __progname);
1676+ fprintf(stderr, "Options:\n");
1677+ fprintf(stderr, " -d Output the log messages to stderr.\n");
1678+ fprintf(stderr, " -e Check the config file for unknown commands.\n");
1679+ fprintf(stderr, " -f file Use alternate config file (default is /etc/ssh/ldap.conf).\n");
1680+ fprintf(stderr, " -s user Do not demonize, send the user's key to stdout.\n");
1681+ fprintf(stderr, " -v Increase verbosity of the debug output (implies -d).\n");
1682+ fprintf(stderr, " -w Warn on unknown commands in the config file.\n");
1683+ exit(1);
501aed94
AM		 1684+}
1685+
3eddefd2
ER		 1686+/*
1687+ * Main program for the ssh pka ldap agent.
1688+ */
1689+
1690+int
1691+main(int ac, char **av)
501aed94 1692+{
3eddefd2
ER		 1693+ int opt;
1694+ FILE *outfile = NULL;
501aed94 1695+
3eddefd2 1696+ __progname = ssh_get_progname(av[0]);
501aed94 1697+
3eddefd2 1698+ log_init(__progname, SYSLOG_LEVEL_DEBUG3, SYSLOG_FACILITY_AUTH, 0);
501aed94 1699+
3eddefd2
ER		 1700+ /*
1701+ * Initialize option structure to indicate that no values have been
1702+ * set.
1703+ */
1704+ initialize_options();
1705+
1706+ /* Parse command-line arguments. */
1707+ while ((opt = getopt(ac, av, "def:s:vw")) != -1) {
1708+ switch (opt) {
1709+ case 'd':
1710+ config_debug = 1;
1711+ break;
1712+
1713+ case 'e':
1714+ config_exclusive_config_file = 1;
1715+ config_warning_config_file = 1;
1716+ break;
1717+
1718+ case 'f':
1719+ config_file_name = optarg;
1720+ break;
1721+
1722+ case 's':
1723+ config_single_user = optarg;
1724+ outfile = fdopen (dup (fileno (stdout)), "w");
1725+ break;
1726+
1727+ case 'v':
1728+ config_debug = 1;
1729+ if (config_verbose < SYSLOG_LEVEL_DEBUG3)
1730+ config_verbose++;
1731+ break;
1732+
1733+ case 'w':
1734+ config_warning_config_file = 1;
1735+ break;
1736+
1737+ case '?':
1738+ default:
1739+ usage();
1740+ break;
501aed94 1741+ }
501aed94 1742+ }
501aed94 1743+
3eddefd2
ER		 1744+ /* Initialize loging */
1745+ log_init(__progname, config_verbose, SYSLOG_FACILITY_AUTH, config_debug);
501aed94 1746+
3eddefd2
ER		 1747+ if (ac != optind)
1748+ fatal ("illegal extra parameter %s", av[1]);
501aed94 1749+
3eddefd2
ER		 1750+ /* Ensure that fds 0 and 2 are open or directed to /dev/null */
1751+ if (config_debug == 0)
1752+ sanitise_stdfd();
501aed94 1753+
3eddefd2
ER		 1754+ /* Read config file */
1755+ read_config_file(config_file_name);
1756+ fill_default_options();
1757+ if (config_verbose == SYSLOG_LEVEL_DEBUG3) {
1758+ debug3 ("=== Configuration ===");
1759+ dump_config();
1760+ debug3 ("=== *** ===");
1761+ }
501aed94 1762+
3eddefd2
ER		 1763+ ldap_checkconfig();
1764+ ldap_do_connect();
501aed94 1765+
3eddefd2
ER		 1766+ if (config_single_user) {
1767+ process_user (config_single_user, outfile);
1768+ } else {
1769+ usage();
1770+ fatal ("Not yet implemented");
1771+/* TODO
1772+ * open unix socket a run the loop on it
1773+ */
1774+ }
501aed94 1775+
3eddefd2
ER		 1776+ ldap_do_close();
1777+ return 0;
501aed94
AM		 1778+}
1779+
3eddefd2 1780+/* Ugly hack */
c4f5c632
AM		 1781+void *buffer_get_string(struct sshbuf *b, u_int *l) { return NULL; }
1782+void buffer_put_string(struct sshbuf *b, const void *f, u_int l) {}
3eddefd2
ER		 1783+
1784diff -up openssh-6.2p1/ldap-helper.h.ldap openssh-6.2p1/ldap-helper.h
1785--- openssh-6.2p1/ldap-helper.h.ldap 2013-03-25 21:27:15.892248097 +0100
1786+++ openssh-6.2p1/ldap-helper.h 2013-03-25 21:27:15.892248097 +0100
1787@@ -0,0 +1,32 @@
1788+/* $OpenBSD: ldap-helper.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
501aed94
AM		 1789+/*
1790+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
1791+ *
1792+ * Redistribution and use in source and binary forms, with or without
1793+ * modification, are permitted provided that the following conditions
1794+ * are met:
1795+ * 1. Redistributions of source code must retain the above copyright
1796+ * notice, this list of conditions and the following disclaimer.
1797+ * 2. Redistributions in binary form must reproduce the above copyright
1798+ * notice, this list of conditions and the following disclaimer in the
1799+ * documentation and/or other materials provided with the distribution.
1800+ *
1801+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
1802+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
1803+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
1804+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
1805+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
1806+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
1807+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
1808+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
1809+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
1810+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1811+ */
1812+
3eddefd2
ER		 1813+#ifndef LDAP_HELPER_H
1814+#define LDAP_HELPER_H
501aed94 1815+
3eddefd2
ER		 1816+extern int config_exclusive_config_file;
1817+extern int config_warning_config_file;
1818+
1819+#endif /* LDAP_HELPER_H */
1820diff -up openssh-6.2p1/ldapincludes.h.ldap openssh-6.2p1/ldapincludes.h
1821--- openssh-6.2p1/ldapincludes.h.ldap 2013-03-25 21:27:15.892248097 +0100
1822+++ openssh-6.2p1/ldapincludes.h 2013-03-25 21:27:15.892248097 +0100
501aed94
AM		 1823@@ -0,0 +1,41 @@
1824+/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
1825+/*
1826+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
1827+ *
1828+ * Redistribution and use in source and binary forms, with or without
1829+ * modification, are permitted provided that the following conditions
1830+ * are met:
1831+ * 1. Redistributions of source code must retain the above copyright
1832+ * notice, this list of conditions and the following disclaimer.
1833+ * 2. Redistributions in binary form must reproduce the above copyright
1834+ * notice, this list of conditions and the following disclaimer in the
1835+ * documentation and/or other materials provided with the distribution.
1836+ *
1837+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
1838+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
1839+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
1840+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
1841+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
1842+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
1843+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
1844+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
1845+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
1846+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1847+ */
1848+
1849+#ifndef LDAPINCLUDES_H
1850+#define LDAPINCLUDES_H
1851+
1852+#include "includes.h"
1853+
1854+#ifdef HAVE_LBER_H
1855+#include <lber.h>
1856+#endif
1857+#ifdef HAVE_LDAP_H
1858+#include <ldap.h>
1859+#endif
1860+#ifdef HAVE_LDAP_SSL_H
1861+#include <ldap_ssl.h>
1862+#endif
1863+
1864+#endif /* LDAPINCLUDES_H */
3eddefd2
ER		 1865diff -up openssh-6.2p1/ldapmisc.c.ldap openssh-6.2p1/ldapmisc.c
1866--- openssh-6.2p1/ldapmisc.c.ldap 2013-03-25 21:27:15.893248104 +0100
1867+++ openssh-6.2p1/ldapmisc.c 2013-03-25 21:27:15.893248104 +0100
501aed94
AM		 1868@@ -0,0 +1,79 @@
1869+
1870+#include "ldapincludes.h"
1871+#include "ldapmisc.h"
1872+
1873+#ifndef HAVE_LDAP_GET_LDERRNO
1874+int
1875+ldap_get_lderrno (LDAP * ld, char **m, char **s)
1876+{
1877+#ifdef HAVE_LDAP_GET_OPTION
1878+ int rc;
1879+#endif
1880+ int lderrno;
1881+
1882+#if defined(HAVE_LDAP_GET_OPTION) && defined(LDAP_OPT_ERROR_NUMBER)
1883+ if ((rc = ldap_get_option (ld, LDAP_OPT_ERROR_NUMBER, &lderrno)) != LDAP_SUCCESS)
1884+ return rc;
1885+#else
1886+ lderrno = ld->ld_errno;
1887+#endif
1888+
1889+ if (s != NULL) {
1890+#if defined(HAVE_LDAP_GET_OPTION) && defined(LDAP_OPT_ERROR_STRING)
1891+ if ((rc = ldap_get_option (ld, LDAP_OPT_ERROR_STRING, s)) != LDAP_SUCCESS)
1892+ return rc;
1893+#else
1894+ *s = ld->ld_error;
1895+#endif
1896+ }
1897+
1898+ if (m != NULL) {
1899+#if defined(HAVE_LDAP_GET_OPTION) && defined(LDAP_OPT_MATCHED_DN)
1900+ if ((rc = ldap_get_option (ld, LDAP_OPT_MATCHED_DN, m)) != LDAP_SUCCESS)
1901+ return rc;
1902+#else
1903+ *m = ld->ld_matched;
1904+#endif
1905+ }
1906+
1907+ return lderrno;
1908+}
1909+#endif
1910+
1911+#ifndef HAVE_LDAP_SET_LDERRNO
1912+int
1913+ldap_set_lderrno (LDAP * ld, int lderrno, const char *m, const char *s)
1914+{
1915+#ifdef HAVE_LDAP_SET_OPTION
1916+ int rc;
1917+#endif
1918+
1919+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_ERROR_NUMBER)
1920+ if ((rc = ldap_set_option (ld, LDAP_OPT_ERROR_NUMBER, &lderrno)) != LDAP_SUCCESS)
1921+ return rc;
1922+#else
1923+ ld->ld_errno = lderrno;
1924+#endif
1925+
1926+ if (s != NULL) {
1927+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_ERROR_STRING)
1928+ if ((rc = ldap_set_option (ld, LDAP_OPT_ERROR_STRING, s)) != LDAP_SUCCESS)
1929+ return rc;
1930+#else
1931+ ld->ld_error = s;
1932+#endif
1933+ }
1934+
1935+ if (m != NULL) {
1936+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_MATCHED_DN)
1937+ if ((rc = ldap_set_option (ld, LDAP_OPT_MATCHED_DN, m)) != LDAP_SUCCESS)
1938+ return rc;
1939+#else
1940+ ld->ld_matched = m;
1941+#endif
1942+ }
1943+
1944+ return LDAP_SUCCESS;
1945+}
1946+#endif
1947+
3eddefd2
ER		 1948diff -up openssh-6.2p1/ldapmisc.h.ldap openssh-6.2p1/ldapmisc.h
1949--- openssh-6.2p1/ldapmisc.h.ldap 2013-03-25 21:27:15.893248104 +0100
1950+++ openssh-6.2p1/ldapmisc.h 2013-03-25 21:27:15.893248104 +0100
501aed94
AM		 1951@@ -0,0 +1,35 @@
1952+/* $OpenBSD: ldapbody.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
1953+/*
1954+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
1955+ *
1956+ * Redistribution and use in source and binary forms, with or without
1957+ * modification, are permitted provided that the following conditions
1958+ * are met:
1959+ * 1. Redistributions of source code must retain the above copyright
1960+ * notice, this list of conditions and the following disclaimer.
1961+ * 2. Redistributions in binary form must reproduce the above copyright
1962+ * notice, this list of conditions and the following disclaimer in the
1963+ * documentation and/or other materials provided with the distribution.
1964+ *
1965+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
1966+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
1967+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
1968+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
1969+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
1970+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
1971+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
1972+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
1973+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
1974+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1975+ */
1976+
1977+#ifndef LDAPMISC_H
1978+#define LDAPMISC_H
1979+
1980+#include "ldapincludes.h"
1981+
1982+int ldap_get_lderrno (LDAP *, char **, char **);
1983+int ldap_set_lderrno (LDAP *, int, const char *, const char *);
1984+
1985+#endif /* LDAPMISC_H */
1986+
f685d17f
JB		 1987--- openssh-7.2p1/Makefile.in.orig 2016-02-26 04:40:04.000000000 +0100
1988+++ openssh-7.2p1/Makefile.in 2016-03-04 19:44:30.903306337 +0100
1989@@ -25,6 +25,8 @@
3eddefd2
ER		 1990 ASKPASS_PROGRAM=$(libexecdir)/ssh-askpass
1991 SFTP_SERVER=$(libexecdir)/sftp-server
1992 SSH_KEYSIGN=$(libexecdir)/ssh-keysign
1993+SSH_LDAP_HELPER=$(libexecdir)/ssh-ldap-helper
1994+SSH_LDAP_WRAPPER=$(libexecdir)/ssh-ldap-wrapper
1995 SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
1996 PRIVSEP_PATH=@PRIVSEP_PATH@
1997 SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
f685d17f 1998@@ -61,8 +63,9 @@
3eddefd2
ER		 1999 EXEEXT=@EXEEXT@
2000 MANFMT=@MANFMT@
048795bf 2001 MKDIR_P=@MKDIR_P@
3eddefd2
ER		 2002+INSTALL_SSH_LDAP_HELPER=@INSTALL_SSH_LDAP_HELPER@
2003
2004-TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT)
2005+TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT)
2006
f685d17f
JB		 2007 LIBOPENSSH_OBJS=\
2008 ssh_api.o \
2009@@ -112,8 +115,8 @@
2010 sandbox-seccomp-filter.o sandbox-capsicum.o sandbox-pledge.o \
2011 sandbox-solaris.o
3eddefd2
ER		 2012
2013-MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out sshd_config.5.out ssh_config.5.out
2014-MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 sshd_config.5 ssh_config.5
2015+MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out ssh-ldap-helper.8.out sshd_config.5.out ssh_config.5.out ssh-ldap.conf.5.out
2016+MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 ssh-ldap-helper.8 sshd_config.5 ssh_config.5 ssh-ldap.conf.5
2017 MANTYPE = @MANTYPE@
2018
2019 CONFIGFILES=sshd_config.out ssh_config.out moduli.out
f685d17f 2020@@ -184,6 +187,9 @@
3eddefd2
ER		 2021 ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-pkcs11-helper.o ssh-pkcs11.o
2022 $(LD) -o $@ ssh-pkcs11-helper.o ssh-pkcs11.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
2023
2024+ssh-ldap-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o
2025+ $(LD) -o $@ ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)
2026+
f685d17f
JB		 2027 ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o
2028 $(LD) -o $@ ssh-keyscan.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
3eddefd2 2029
f685d17f 2030@@ -311,6 +317,10 @@
3eddefd2
ER		 2031 $(INSTALL) -m 0755 $(STRIP_OPT) sshd$(EXEEXT) $(DESTDIR)$(sbindir)/sshd$(EXEEXT)
2032 $(INSTALL) -m 4711 $(STRIP_OPT) ssh-keysign$(EXEEXT) $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
2033 $(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
2034+ if test ! -z "$(INSTALL_SSH_LDAP_HELPER)" ; then \
2035+ $(INSTALL) -m 0700 $(STRIP_OPT) ssh-ldap-helper $(DESTDIR)$(SSH_LDAP_HELPER) ; \
2036+ $(INSTALL) -m 0700 ssh-ldap-wrapper $(DESTDIR)$(SSH_LDAP_WRAPPER) ; \
2037+ fi
2038 $(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
2039 $(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
2040 $(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
f685d17f 2041@@ -327,6 +337,10 @@
3eddefd2
ER		 2042 $(INSTALL) -m 644 sftp-server.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
2043 $(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
2044 $(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
2045+ if test ! -z "$(INSTALL_SSH_LDAP_HELPER)" ; then \
2046+ $(INSTALL) -m 644 ssh-ldap-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-ldap-helper.8 ; \
2047+ $(INSTALL) -m 644 ssh-ldap.conf.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/ssh-ldap.conf.5 ; \
2048+ fi
f685d17f
JB		 2049
2050 install-sysconf:
2051 if [ ! -d $(DESTDIR)$(sysconfdir) ]; then \
2052@@ -352,6 +366,13 @@
3eddefd2
ER		 2053 else \
2054 echo "$(DESTDIR)$(sysconfdir)/moduli already exists, install will not overwrite"; \
2055 fi
2056+ if test ! -z "$(INSTALL_SSH_LDAP_HELPER)" ; then \
2057+ if [ ! -f $(DESTDIR)$(sysconfdir)/ldap.conf ]; then \
2058+ $(INSTALL) -m 644 ldap.conf $(DESTDIR)$(sysconfdir)/ldap.conf; \
2059+ else \
2060+ echo "$(DESTDIR)$(sysconfdir)/ldap.conf already exists, install will not overwrite"; \
2061+ fi ; \
2062+ fi
2063
2064 host-key: ssh-keygen$(EXEEXT)
2065 @if [ -z "$(DESTDIR)" ] ; then \
f685d17f 2066@@ -392,6 +413,8 @@
3eddefd2
ER		 2067 -rm -r $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
2068 -rm -f $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
2069 -rm -f $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
2070+ -rm -f $(DESTDIR)$(SSH_LDAP_HELPER)$(EXEEXT)
2071+ -rm -f $(DESTDIR)$(SSH_LDAP_WRAPPER)$(EXEEXT)
2072 -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
2073 -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
2074 -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
f685d17f 2075@@ -403,6 +426,7 @@
3eddefd2
ER		 2076 -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
2077 -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
2078 -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
2079+ -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-ldap-helper.8
3eddefd2 2080
f685d17f
JB		 2081 regress-prep:
2082 [ -d `pwd`/regress ] || mkdir -p `pwd`/regress
3eddefd2
ER		 2083diff -up openssh-6.2p1/openssh-lpk-openldap.schema.ldap openssh-6.2p1/openssh-lpk-openldap.schema
2084--- openssh-6.2p1/openssh-lpk-openldap.schema.ldap 2013-03-25 21:27:15.894248110 +0100
2085+++ openssh-6.2p1/openssh-lpk-openldap.schema 2013-03-25 21:27:15.894248110 +0100
501aed94
AM		 2086@@ -0,0 +1,21 @@
2087+#
2088+# LDAP Public Key Patch schema for use with openssh-ldappubkey
2089+# useful with PKA-LDAP also
2090+#
2091+# Author: Eric AUGE <eau@phear.org>
2092+#
2093+# Based on the proposal of : Mark Ruijter
2094+#
2095+
2096+
2097+# octetString SYNTAX
2098+attributetype ( 1.3.6.1.4.1.24552.500.1.1.1.13 NAME 'sshPublicKey'
2099+ DESC 'MANDATORY: OpenSSH Public key'
2100+ EQUALITY octetStringMatch
2101+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
2102+
2103+# printableString SYNTAX yes|no
2104+objectclass ( 1.3.6.1.4.1.24552.500.1.1.2.0 NAME 'ldapPublicKey' SUP top AUXILIARY
2105+ DESC 'MANDATORY: OpenSSH LPK objectclass'
2106+ MUST ( sshPublicKey $ uid )
2107+ )
3eddefd2
ER		 2108diff -up openssh-6.2p1/openssh-lpk-sun.schema.ldap openssh-6.2p1/openssh-lpk-sun.schema
2109--- openssh-6.2p1/openssh-lpk-sun.schema.ldap 2013-03-25 21:27:15.894248110 +0100
2110+++ openssh-6.2p1/openssh-lpk-sun.schema 2013-03-25 21:27:15.894248110 +0100
501aed94
AM		 2111@@ -0,0 +1,23 @@
2112+#
2113+# LDAP Public Key Patch schema for use with openssh-ldappubkey
2114+# useful with PKA-LDAP also
2115+#
2116+# Author: Eric AUGE <eau@phear.org>
2117+#
2118+# Schema for Sun Directory Server.
2119+# Based on the original schema, modified by Stefan Fischer.
2120+#
2121+
2122+dn: cn=schema
2123+
2124+# octetString SYNTAX
2125+attributeTypes: ( 1.3.6.1.4.1.24552.500.1.1.1.13 NAME 'sshPublicKey'
2126+ DESC 'MANDATORY: OpenSSH Public key'
2127+ EQUALITY octetStringMatch
2128+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
2129+
2130+# printableString SYNTAX yes|no
2131+objectClasses: ( 1.3.6.1.4.1.24552.500.1.1.2.0 NAME 'ldapPublicKey' SUP top AUXILIARY
2132+ DESC 'MANDATORY: OpenSSH LPK objectclass'
2133+ MUST ( sshPublicKey $ uid )
2134+ )
3eddefd2
ER		 2135diff -up openssh-6.2p2/ssh-ldap.conf.5.ldap openssh-6.2p2/ssh-ldap.conf.5
2136--- openssh-6.2p2/ssh-ldap.conf.5.ldap 2013-06-07 15:10:05.604942680 +0200
2137+++ openssh-6.2p2/ssh-ldap.conf.5 2013-06-07 15:10:24.928857566 +0200
2138@@ -0,0 +1,379 @@
501aed94
AM		 2139+.\" $OpenBSD: ssh-ldap.conf.5,v 1.1 2010/02/10 23:20:38 markus Exp $
2140+.\"
2141+.\" Copyright (c) 2010 Jan F. Chadima. All rights reserved.
2142+.\"
2143+.\" Permission to use, copy, modify, and distribute this software for any
2144+.\" purpose with or without fee is hereby granted, provided that the above
2145+.\" copyright notice and this permission notice appear in all copies.
2146+.\"
2147+.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
2148+.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
2149+.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
2150+.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
2151+.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
2152+.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
2153+.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
2154+.\"
2155+.Dd $Mdocdate: may 12 2010 $
2156+.Dt SSH-LDAP.CONF 5
2157+.Os
2158+.Sh NAME
2159+.Nm ssh-ldap.conf
2160+.Nd configuration file for ssh-ldap-helper
2161+.Sh SYNOPSIS
2162+.Nm /etc/ssh/ldap.conf
2163+.Sh DESCRIPTION
2164+.Xr ssh-ldap-helper 8
2165+reads configuration data from
2166+.Pa /etc/ssh/ldap.conf
2167+(or the file specified with
2168+.Fl f
2169+on the command line).
2170+The file contains keyword-argument pairs, one per line.
2171+Lines starting with
2172+.Ql #
2173+and empty lines are interpreted as comments.
2174+.Pp
2175+The value starts with the first non-blank character after
2176+the keyword's name, and terminates at the end of the line,
2177+or at the last sequence of blanks before the end of the line.
2178+Quoting values that contain blanks
2179+may be incorrect, as the quotes would become part of the value.
2180+The possible keywords and their meanings are as follows (note that
2181+keywords are case-insensitive, and arguments, on a case by case basis, may be case-sensitive).
2182+.Bl -tag -width Ds
2183+.It Cm URI
2184+The argument(s) are in the form
2185+.Pa ldap[si]://[name[:port]]
2186+and specify the URI(s) of an LDAP server(s) to which the
2187+.Xr ssh-ldap-helper 8
2188+should connect. The URI scheme may be any of
2189+.Dq ldap ,
2190+.Dq ldaps
2191+or
2192+.Dq ldapi ,
2193+which refer to LDAP over TCP, LDAP over SSL (TLS) and LDAP
2194+over IPC (UNIX domain sockets), respectively.
2195+Each server's name can be specified as a
2196+domain-style name or an IP address literal. Optionally, the
2197+server's name can followed by a ':' and the port number the LDAP
2198+server is listening on. If no port number is provided, the default
2199+port for the scheme is used (389 for ldap://, 636 for ldaps://).
2200+For LDAP over IPC, name is the name of the socket, and no port
2201+is required, nor allowed; note that directory separators must be
2202+URL-encoded, like any other characters that are special to URLs;
2203+A space separated list of URIs may be provided.
2204+There is no default.
2205+.It Cm Base
2206+Specifies the default base Distinguished Name (DN) to use when performing ldap operations.
2207+The base must be specified as a DN in LDAP format.
2208+There is no default.
2209+.It Cm BindDN
2210+Specifies the default BIND DN to use when connecting to the ldap server.
2211+The bind DN must be specified as a Distinguished Name in LDAP format.
2212+There is no default.
2213+.It Cm BindPW
2214+Specifies the default password to use when connecting to the ldap server via
2215+.Cm BindDN .
2216+There is no default.
2217+.It Cm RootBindDN
2218+Intentionaly does nothing. Recognized for compatibility reasons.
2219+.It Cm Host
2220+The argument(s) specifies the name(s) of an LDAP server(s) to which the
2221+.Xr ssh-ldap-helper 8
2222+should connect. Each server's name can be specified as a
2223+domain-style name or an IP address and optionally followed by a ':' and
2224+the port number the ldap server is listening on. A space-separated
2225+list of hosts may be provided.
2226+There is no default.
2227+.Cm Host
2228+is deprecated in favor of
2229+.Cm URI .
2230+.It Cm Port
2231+Specifies the default port used when connecting to LDAP servers(s).
2232+The port may be specified as a number.
2233+The default port is 389 for ldap:// or 636 for ldaps:// respectively.
2234+.Cm Port
2235+is deprecated in favor of
2236+.Cm URI .
2237+.It Cm Scope
2238+Specifies the starting point of an LDAP search and the depth from the base DN to which the search should descend.
2239+There are three options (values) that can be assigned to the
2240+.Cm Scope parameter:
2241+.Dq base ,
2242+.Dq one
2243+and
2244+.Dq subtree .
2245+Alias for the subtree is
2246+.Dq sub .
2247+The value
2248+.Dq base
2249+is used to indicate searching only the entry at the base DN, resulting in only that entry being returned (keeping in mind that it also has to meet the search filter criteria!).
2250+The value
2251+.Dq one
2252+is used to indicate searching all entries one level under the base DN, but not including the base DN and not including any entries under that one level under the base DN.
2253+The value
2254+.Dq subtree
2255+is used to indicate searching of all entries at all levels under and including the specified base DN.
2256+The default is
2257+.Dq subtree .
2258+.It Cm Deref
2259+Specifies how alias dereferencing is done when performing a search. There are four
2260+possible values that can be assigned to the
2261+.Cm Deref
2262+parameter:
2263+.Dq never ,
2264+.Dq searching ,
2265+.Dq finding ,
2266+and
2267+.Dq always .
2268+The value
2269+.Dq never
2270+means that the aliases are never dereferenced.
2271+The value
2272+.Dq searching
2273+means that the aliases are dereferenced in subordinates of the base object, but
2274+not in locating the base object of the search.
2275+The value
2276+.Dq finding
2277+means that the aliases are only dereferenced when locating the base object of the search.
2278+The value
2279+.Dq always
2280+means that the aliases are dereferenced both in searching and in locating the base object
2281+of the search.
2282+The default is
2283+.Dq never .
2284+.It Cm TimeLimit
2285+Specifies a time limit (in seconds) to use when performing searches.
2286+The number should be a non-negative integer. A
2287+.Cm TimeLimit
2288+of zero (0) specifies that the search time is unlimited. Please note that the server
2289+may still apply any server-side limit on the duration of a search operation.
2290+The default value is 10.
2291+.It Cm TimeOut
2292+Is an aliast to
2293+.Cm TimeLimit .
2294+.It Cm Bind_TimeLimit
2295+Specifies the timeout (in seconds) after which the poll(2)/select(2)
2296+following a connect(2) returns in case of no activity.
2297+The default value is 10.
2298+.It Cm Network_TimeOut
2299+Is an alias to
2300+.Cm Bind_TimeLimit .
2301+.It Cm Ldap_Version
2302+Specifies what version of the LDAP protocol should be used.
2303+The allowed values are 2 or 3. The default is 3.
2304+.It Cm Version
2305+Is an alias to
2306+.Cm Ldap_Version .
2307+.It Cm Bind_Policy
2308+Specifies the policy to use for reconnecting to an unavailable LDAP server. There are 2 available values:
2309+.Dq hard
2310+and
2311+.Dq soft.
2312+.Dq hard has 2 aliases
2313+.Dq hard_open
2314+and
2315+.Dq hard_init .
2316+The value
2317+.Dq hard
2318+means that reconects that the
2319+.Xr ssh-ldap-helper 8
2320+tries to reconnect to the LDAP server 5 times before failure. There is exponential backoff before retrying.
2321+The value
2322+.Dq soft
2323+means that
2324+.Xr ssh-ldap-helper 8
2325+fails immediately when it cannot connect to the LDAP seerver.
2326+The deault is
2327+.Dq hard .
2328+.It Cm SSLPath
2329+Specifies the path to the X.509 certificate database.
2330+There is no default.
2331+.It Cm SSL
2332+Specifies whether to use SSL/TLS or not.
2333+There are three allowed values:
2334+.Dq yes ,
2335+.Dq no
2336+and
2337+.Dq start_tls
2338+Both
2339+.Dq true
2340+and
2341+.Dq on
2342+are the aliases for
2343+.Dq yes .
2344+.Dq false
2345+and
2346+.Dq off
2347+are the aliases for
2348+.Dq no .
2349+If
2350+.Dq start_tls
2351+is specified then StartTLS is used rather than raw LDAP over SSL.
2352+The default for ldap:// is
2353+.Dq start_tls ,
2354+for ldaps://
2355+.Dq yes
2356+and
2357+.Dq no
2358+for the ldapi:// .
2359+In case of host based configuration the default is
2360+.Dq start_tls .
2361+.It Cm Referrals
2362+Specifies if the client should automatically follow referrals returned
2363+by LDAP servers.
2364+The value can be or
2365+.Dq yes
2366+or
2367+.Dq no .
2368+.Dq true
2369+and
2370+.Dq on
2371+are the aliases for
2372+.Dq yes .
2373+.Dq false
2374+and
2375+.Dq off
2376+are the aliases for
2377+.Dq no .
2378+The default is yes.
2379+.It Cm Restart
2380+Specifies whether the LDAP client library should restart the select(2) system call when interrupted.
2381+The value can be or
2382+.Dq yes
2383+or
2384+.Dq no .
2385+.Dq true
2386+and
2387+.Dq on
2388+are the aliases for
2389+.Dq yes .
2390+.Dq false
2391+and
2392+.Dq off
2393+are the aliases for
2394+.Dq no .
2395+The default is yes.
2396+.It Cm TLS_CheckPeer
2397+Specifies what checks to perform on server certificates in a TLS session,
2398+if any. The value
2399+can be specified as one of the following keywords:
2400+.Dq never ,
2401+.Dq hard ,
2402+.Dq demand ,
2403+.Dq allow
2404+and
2405+.Dq try .
2406+.Dq true ,
2407+.Dq on
2408+and
2409+.Dq yes
2410+are aliases for
2411+.Dq hard .
2412+.Dq false ,
2413+.Dq off
2414+and
2415+.Dq no
2416+are the aliases for
2417+.Dq never .
2418+The value
2419+.Dq never
2420+means that the client will not request or check any server certificate.
2421+The value
2422+.Dq allow
2423+means that the server certificate is requested. If no certificate is provided,
2424+the session proceeds normally. If a bad certificate is provided, it will
2425+be ignored and the session proceeds normally.
2426+The value
2427+.Dq try
2428+means that the server certificate is requested. If no certificate is provided,
2429+the session proceeds normally. If a bad certificate is provided,
2430+the session is immediately terminated.
2431+The value
2432+.Dq demand
2433+means that the server certificate is requested. If no
2434+certificate is provided, or a bad certificate is provided, the session
2435+is immediately terminated.
2436+The value
2437+.Dq hard
2438+is the same as
2439+.Dq demand .
2440+It requires an SSL connection. In the case of the plain conection the
2441+session is immediately terminated.
2442+The default is
2443+.Dq hard .
2444+.It Cm TLS_ReqCert
2445+Is an alias for
2446+.Cm TLS_CheckPeer .
2447+.It Cm TLS_CACertFile
2448+Specifies the file that contains certificates for all of the Certificate
2449+Authorities the client will recognize.
2450+There is no default.
2451+.It Cm TLS_CACert
2452+Is an alias for
2453+.Cm TLS_CACertFile .
2454+.It Cm TLS_CACertDIR
2455+Specifies the path of a directory that contains Certificate Authority
2456+certificates in separate individual files. The
2457+.Cm TLS_CACert
2458+is always used before
2459+.Cm TLS_CACertDir .
2460+The specified directory must be managed with the OpenSSL c_rehash utility.
2461+There is no default.
2462+.It Cm TLS_Ciphers
2463+Specifies acceptable cipher suite and preference order.
2464+The value should be a cipher specification for OpenSSL,
2465+e.g.,
2466+.Dq HIGH:MEDIUM:+SSLv2 .
2467+The default is
2468+.Dq ALL .
2469+.It Cm TLS_Cipher_Suite
2470+Is an alias for
2471+.Cm TLS_Ciphers .
2472+.It Cm TLS_Cert
2473+Specifies the file that contains the client certificate.
2474+There is no default.
2475+.It Cm TLS_Certificate
2476+Is an alias for
2477+.Cm TLS_Cert .
2478+.It Cm TLS_Key
2479+Specifies the file that contains the private key that matches the certificate
2480+stored in the
2481+.Cm TLS_Cert
2482+file. Currently, the private key must not be protected with a password, so
2483+it is of critical importance that the key file is protected carefully.
2484+There is no default.
2485+.It Cm TLS_RandFile
2486+Specifies the file to obtain random bits from when /dev/[u]random is
2487+not available. Generally set to the name of the EGD/PRNGD socket.
2488+The environment variable RANDFILE can also be used to specify the filename.
2489+There is no default.
2490+.It Cm LogDir
2491+Specifies the directory used for logging by the LDAP client library.
2492+There is no default.
2493+.It Cm Debug
2494+Specifies the debug level used for logging by the LDAP client library.
2495+There is no default.
2496+.It Cm SSH_Filter
2497+Specifies the user filter applied on the LDAP serch.
2498+The default is no filter.
3eddefd2
ER		 2499+.It Cm AccountClass
2500+Specifies the LDAP class used to find user accounts.
2501+The default is posixAccount.
501aed94
AM		 2502+.El
2503+.Sh FILES
2504+.Bl -tag -width Ds
2505+.It Pa /etc/ssh/ldap.conf
2506+Ldap configuration file for
2507+.Xr ssh-ldap-helper 8 .
2508+.El
2509+.Sh "SEE ALSO"
2510+.Xr ldap.conf 5 ,
2511+.Xr ssh-ldap-helper 8
2512+.Sh HISTORY
2513+.Nm
2514+first appeared in
2515+OpenSSH 5.5 + PKA-LDAP .
2516+.Sh AUTHORS
2517+.An Jan F. Chadima Aq jchadima@redhat.com
3eddefd2
ER		 2518diff -up openssh-6.2p1/ssh-ldap-helper.8.ldap openssh-6.2p1/ssh-ldap-helper.8
2519--- openssh-6.2p1/ssh-ldap-helper.8.ldap 2013-03-25 21:27:15.895248117 +0100
2520+++ openssh-6.2p1/ssh-ldap-helper.8 2013-03-25 21:27:15.895248117 +0100
2521@@ -0,0 +1,79 @@
2522+.\" $OpenBSD: ssh-ldap-helper.8,v 1.1 2010/02/10 23:20:38 markus Exp $
2523+.\"
2524+.\" Copyright (c) 2010 Jan F. Chadima. All rights reserved.
2525+.\"
2526+.\" Permission to use, copy, modify, and distribute this software for any
2527+.\" purpose with or without fee is hereby granted, provided that the above
2528+.\" copyright notice and this permission notice appear in all copies.
2529+.\"
2530+.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
2531+.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
2532+.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
2533+.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
2534+.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
2535+.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
2536+.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
2537+.\"
2538+.Dd $Mdocdate: April 29 2010 $
2539+.Dt SSH-LDAP-HELPER 8
2540+.Os
2541+.Sh NAME
2542+.Nm ssh-ldap-helper
2543+.Nd sshd helper program for ldap support
2544+.Sh SYNOPSIS
2545+.Nm ssh-ldap-helper
2546+.Op Fl devw
2547+.Op Fl f Ar file
2548+.Op Fl s Ar user
2549+.Sh DESCRIPTION
2550+.Nm
2551+is used by
2552+.Xr sshd 1
2553+to access keys provided by an LDAP.
2554+.Nm
2555+is disabled by default and can only be enabled in the
2556+sshd configuration file
2557+.Pa /etc/ssh/sshd_config
2558+by setting
2559+.Cm AuthorizedKeysCommand
2560+to
2561+.Dq /usr/libexec/ssh-ldap-wrapper .
2562+.Pp
2563+.Nm
2564+is not intended to be invoked by the user, but from
2565+.Xr sshd 8 via
2566+.Xr ssh-ldap-wrapper .
2567+.Pp
2568+The options are as follows:
2569+.Bl -tag -width Ds
2570+.It Fl d
2571+Set the debug mode;
2572+.Nm
2573+prints all logs to stderr instead of syslog.
2574+.It Fl e
2575+Implies \-w;
2576+.Nm
2577+halts if it encounters an unknown item in the ldap.conf file.
2578+.It Fl f
2579+.Nm
2580+uses this file as the ldap configuration file instead of /etc/ssh/ldap.conf (default).
2581+.It Fl s
2582+.Nm
2583+prints out the user's keys to stdout and exits.
2584+.It Fl v
2585+Implies \-d;
2586+increases verbosity.
2587+.It Fl w
2588+.Nm
2589+writes warnings about unknown items in the ldap.conf configuration file.
2590+.El
2591+.Sh SEE ALSO
2592+.Xr sshd 8 ,
2593+.Xr sshd_config 5 ,
2594+.Xr ssh-ldap.conf 5 ,
2595+.Sh HISTORY
2596+.Nm
2597+first appeared in
2598+OpenSSH 5.5 + PKA-LDAP .
2599+.Sh AUTHORS
2600+.An Jan F. Chadima Aq jchadima@redhat.com
2601diff -up openssh-6.2p1/ssh-ldap-wrapper.ldap openssh-6.2p1/ssh-ldap-wrapper
2602--- openssh-6.2p1/ssh-ldap-wrapper.ldap 2013-03-25 21:27:15.896248124 +0100
2603+++ openssh-6.2p1/ssh-ldap-wrapper 2013-03-25 21:27:15.896248124 +0100
2604@@ -0,0 +1,4 @@
2605+#!/bin/sh
2606+
2607+exec /usr/libexec/openssh/ssh-ldap-helper -s "$1"
2608+
OpenSSH free Secure Shell (SSH) implementation
This page took 0.464108 seconds and 4 git commands to generate.