+ else
+ error("Host key %s blacklisted (see "
+ "ssh-vulnkey(1))", fp);
-+ xfree(fp);
++ free(fp);
+ if (!options.permit_blacklisted_keys) {
+ sensitive_data.host_keys[i] = NULL;
+ continue;
+ }
+ }
+ pubkey = key_load_public(options.host_key_files[i], NULL);
sensitive_data.host_keys[i] = key;
- if (key == NULL) {
- error("Could not load host key: %s",
+ sensitive_data.host_pubkeys[i] = pubkey;
--- openssh-4.7p1.orig/servconf.c
+++ openssh-4.7p1/servconf.c
@@ -96,6 +96,7 @@
{ "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL },
{ "strictmodes", sStrictModes, SSHCFG_GLOBAL },
+ { "permitblacklistedkeys", sPermitBlacklistedKeys, SSHCFG_GLOBAL },
- { "permitemptypasswords", sEmptyPasswd, SSHCFG_GLOBAL },
+ { "permitemptypasswords", sEmptyPasswd, SSHCFG_ALL },
{ "permituserenvironment", sPermitUserEnvironment, SSHCFG_GLOBAL },
{ "uselogin", sUseLogin, SSHCFG_GLOBAL },
@@ -943,6 +947,10 @@
--- openssh-4.7p1.orig/servconf.h
+++ openssh-4.7p1/servconf.h
@@ -94,6 +94,7 @@
- * authentication. */
+ * authentication. /
int kbd_interactive_authentication; /* If true, permit */
int challenge_response_authentication;
+ int permit_blacklisted_keys; /* If true, permit */
+ int zero_knowledge_password_authentication;
+ /* If true, permit jpake auth */
int permit_empty_passwd; /* If false, do not permit empty
- * passwords. */
- int permit_user_env; /* If true, read ~/.ssh/environment */
--- openssh-4.7p1.orig/Makefile.in
+++ openssh-4.7p1/Makefile.in
-@@ -60,7 +60,7 @@
+@@ -62,7 +62,7 @@
INSTALL_SSH_PRNG_CMDS=@INSTALL_SSH_PRNG_CMDS@
INSTALL_SSH_RAND_HELPER=@INSTALL_SSH_RAND_HELPER@
--TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-agent$(EXEEXT) scp$(EXEEXT) ssh-rand-helper${EXEEXT} sftp-server$(EXEEXT) sftp$(EXEEXT)
-+TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-agent$(EXEEXT) scp$(EXEEXT) ssh-rand-helper${EXEEXT} sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-vulnkey$(EXEEXT)
+-TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT)
++TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT) ssh-vulnkey$(EXEEXT)
LIBSSH_OBJS=acss.o authfd.o authfile.o bufaux.o bufbn.o buffer.o \
canohost.o channels.o cipher.o cipher-acss.o cipher-aes.o \
-@@ -88,8 +88,8 @@
- loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o \
- audit.o audit-bsm.o platform.o
+@@ -93,8 +93,8 @@
+ audit.o audit-bsm.o platform.o sftp-server.o sftp-common.o \
+ roaming_common.o roaming_serv.o ldapauth.o
--MANPAGES = scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-rand-helper.8.out ssh-keysign.8.out sshd_config.5.out ssh_config.5.out
--MANPAGES_IN = scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-rand-helper.8 ssh-keysign.8 sshd_config.5 ssh_config.5
-+MANPAGES = scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-rand-helper.8.out ssh-keysign.8.out ssh-vulnkey.1.out sshd_config.5.out ssh_config.5.out
-+MANPAGES_IN = scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-rand-helper.8 ssh-keysign.8 ssh-vulnkey.1 sshd_config.5 ssh_config.5
+-MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out ssh-ldap-helper.8.out sshd_config.5.out ssh_config.5.out ssh-ldap.conf.5.out
+-MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 ssh-ldap-helper.8 sshd_config.5 ssh_config.5 ssh-ldap.conf.5
++MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out ssh-ldap-helper.8.out sshd_config.5.out ssh_config.5.out ssh-ldap.conf.5.out ssh-vulnkey.1.out
++MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 ssh-ldap-helper.8 sshd_config.5 ssh_config.5 ssh-ldap.conf.5 ssh-vulnkey.1
MANTYPE = @MANTYPE@
CONFIGFILES=sshd_config.out ssh_config.out moduli.out
# test driver for the loginrec code - not built by default
logintest: logintest.o $(LIBCOMPAT) libssh.a loginrec.o
$(LD) -o $@ logintest.o $(LDFLAGS) loginrec.o -lopenbsd-compat -lssh $(LIBS)
-@@ -264,6 +267,7 @@
- $(INSTALL) -m 4711 $(STRIP_OPT) ssh-keysign $(DESTDIR)$(SSH_KEYSIGN)
- $(INSTALL) -m 0755 $(STRIP_OPT) sftp $(DESTDIR)$(bindir)/sftp
- $(INSTALL) -m 0755 $(STRIP_OPT) sftp-server $(DESTDIR)$(SFTP_SERVER)
-+ $(INSTALL) -m 0755 $(STRIP_OPT) ssh-vulnkey $(DESTDIR)$(bindir)/ssh-vulnkey
+@@ -271,6 +274,7 @@
+ $(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
+ $(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
+ $(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
++ $(INSTALL) -m 0755 $(STRIP_OPT) ssh-vulnkey$(EXEEXT) $(DESTDIR)$(bindir)/ssh-vulnkey$(EXEEXT)
$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
$(INSTALL) -m 644 scp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
$(INSTALL) -m 644 ssh-add.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
-@@ -280,6 +284,7 @@
+@@ -289,6 +293,7 @@
$(INSTALL) -m 644 sftp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/sftp.1
$(INSTALL) -m 644 sftp-server.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
$(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
+ $(INSTALL) -m 644 ssh-vulnkey.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-vulnkey.1
+ $(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
-rm -f $(DESTDIR)$(bindir)/slogin
- ln -s ssh$(EXEEXT) $(DESTDIR)$(bindir)/slogin
- -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1
+ ln -s ./ssh$(EXEEXT) $(DESTDIR)$(bindir)/slogin
@@ -361,6 +366,7 @@
-rm -f $(DESTDIR)$(bindir)/ssh-agent$(EXEEXT)
-rm -f $(DESTDIR)$(bindir)/ssh-keygen$(EXEEXT)
+ else
+ logit("Public key %s blacklisted (see "
+ "ssh-vulnkey(1))", fp);
-+ xfree(fp);
++ free(fp);
+ if (!options.permit_blacklisted_keys)
+ return 0;
+ }
+
- /* Check if we would accept it using rhosts authentication. */
- if (!auth_rhosts(pw, cuser))
+ if (auth_key_is_revoked(client_host_key))
return 0;
+
--- openssh-4.7p1.orig/authfile.h
+++ openssh-4.7p1/authfile.h
@@ -23,4 +23,7 @@
+of processing
+.Xr ssh-keyscan 1
+output.
---- openssh-4.7p1.orig/auth2-hostbased.c
-+++ openssh-4.7p1/auth2-hostbased.c
+--- openssh-5.6p1/auth2-hostbased.c~ 2010-08-24 14:10:03.000000000 +0300
++++ openssh-5.6p1/auth2-hostbased.c 2010-08-24 14:12:10.632553591 +0300
@@ -40,6 +40,7 @@
#include "compat.h"
#include "key.h"
#include "auth.h"
#include "canohost.h"
#ifdef GSSAPI
-@@ -141,10 +142,24 @@
- hostbased_key_allowed(struct passwd *pw, const char *cuser, char *chost,
- Key *key)
- {
-+ char *fp;
- const char *resolvedname, *ipaddr, *lookup;
- HostStatus host_status;
+@@ -147,6 +148,19 @@
int len;
+ char *fp;
+ if (blacklisted_key(key)) {
+ fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
+ else
+ logit("Public key %s blacklisted (see "
+ "ssh-vulnkey(1))", fp);
-+ xfree(fp);
++ free(fp);
+ if (!options.permit_blacklisted_keys)
+ return 0;
+ }
+
- resolvedname = get_canonical_hostname(options.use_dns);
- ipaddr = get_remote_ipaddr();
+ if (auth_key_is_revoked(key))
+ return 0;
--- openssh-4.7p1.orig/authfile.c
+++ openssh-4.7p1/authfile.c
/* Version identification string for SSH v1 identity files. */
static const char authfile_id_string[] =
@@ -677,3 +678,113 @@
- key_free(pub);
- return NULL;
+ return ret;
}
+
+
+char *
+blacklist_filename(const Key *key)
+
+out:
+ if (dgst_packed)
-+ xfree(dgst_packed);
++ free(dgst_packed);
+ if (dgst_hex)
-+ xfree(dgst_hex);
++ free(dgst_hex);
+ if (fd >= 0)
+ close(fd);
-+ xfree(blacklist_file);
++ free(blacklist_file);
+ return ret;
+}
--- openssh-4.7p1.orig/ssh-vulnkey.c
+ fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
+ if (!quiet)
+ printf("%s: %u %s %s\n", msg, key_size(key), fp, comment);
-+ xfree(fp);
++ free(fp);
+}
+
+int
+ ret = 0;
+ } else
+ describe_key("Not blacklisted", key, comment);
-+ xfree(blacklist_file);
++ free(blacklist_file);
+
+ return ret;
+}
+ found = 1;
+ }
+ if (comment)
-+ xfree(comment);
++ free(comment);
+ }
+
+ return ret;
+ /* We don't need the RNG ourselves, but symbol references here allow
+ * ld to link us properly.
+ */
-+ init_rng();
-+ seed_rng();
++ //init_rng();
++ //seed_rng();
+
+ while ((opt = getopt(argc, argv, "ahq")) != -1) {
+ switch (opt) {
+ else
+ logit("Public key %s blacklisted (see "
+ "ssh-vulnkey(1))", fp);
-+ xfree(fp);
++ free(fp);
+ if (!options.permit_blacklisted_keys)
+ continue;
+ }
#ifndef _PATH_SSH_PROGRAM
#define _PATH_SSH_PROGRAM "/usr/bin/ssh"
#endif
---- openssh-4.7p1.orig/auth2-pubkey.c
-+++ openssh-4.7p1/auth2-pubkey.c
+--- openssh-5.9p1/auth2-pubkey.c~ 2011-09-29 00:36:17.000000000 +0300
++++ openssh-5.9p1/auth2-pubkey.c 2011-09-29 00:37:17.847762648 +0300
@@ -42,6 +42,7 @@
#include "compat.h"
#include "key.h"
#include "auth.h"
#include "pathnames.h"
#include "uidswap.h"
-@@ -269,9 +270,23 @@
- int
- user_key_allowed(struct passwd *pw, Key *key)
+@@ -608,6 +609,20 @@
{
-+ char *fp;
- int success;
+ u_int success, i;
char *file;
-
++ char *fp;
++
+ if (blacklisted_key(key)) {
+ fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
+ if (options.permit_blacklisted_keys)
+ logit("Public key %s blacklisted (see "
-+ "ssh-vulnkey(1)); continuing anyway", fp);
++ "ssh-vulnkey(1)); continuing anyway", fp);
+ else
+ logit("Public key %s blacklisted (see "
-+ "ssh-vulnkey(1))", fp);
-+ xfree(fp);
++ "ssh-vulnkey(1))", fp);
++ free(fp);
+ if (!options.permit_blacklisted_keys)
+ return 0;
+ }
-+
- file = authorized_keys_file(pw);
- success = user_key_allowed2(pw, key, file);
- xfree(file);
+
+ if (auth_key_is_revoked(key))
+ return 0;
+
projects / packages / openssh.git / blobdiff