diff options
Diffstat (limited to 'security/openssh')
| -rw-r--r-- | security/openssh/Makefile | 2 | ||||
| -rw-r--r-- | security/openssh/files/patch-auth1.c | 105 | ||||
| -rw-r--r-- | security/openssh/files/patch-auth2.c | 98 | ||||
| -rw-r--r-- | security/openssh/files/patch-session.c | 257 | ||||
| -rw-r--r-- | security/openssh/files/patch-ssh-Makefile | 6 | ||||
| -rw-r--r-- | security/openssh/files/patch-ssh-keyscan-Makefile | 8 | ||||
| -rw-r--r-- | security/openssh/files/sshd.sh | 43 |
7 files changed, 461 insertions, 58 deletions
diff --git a/security/openssh/Makefile b/security/openssh/Makefile index b814a5e0f244..7dc1c72c4c2d 100644 --- a/security/openssh/Makefile +++ b/security/openssh/Makefile @@ -7,7 +7,7 @@ PORTNAME= openssh PORTVERSION= 3.1 -PORTREVISION= 3 +PORTREVISION= 4 CATEGORIES= security MASTER_SITES= ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/ \ ftp://ftp.usa.openbsd.org/pub/OpenBSD/OpenSSH/ \ diff --git a/security/openssh/files/patch-auth1.c b/security/openssh/files/patch-auth1.c new file mode 100644 index 000000000000..7be939c24a5a --- /dev/null +++ b/security/openssh/files/patch-auth1.c @@ -0,0 +1,105 @@ +--- auth1.c.orig Sun Feb 3 18:53:25 2002 ++++ auth1.c Sun Mar 17 20:14:40 2002 +@@ -75,6 +75,18 @@ + u_int ulen; + int type = 0; + struct passwd *pw = authctxt->pw; ++#ifdef HAVE_LOGIN_CAP ++ login_cap_t *lc; ++#endif ++#ifdef USE_PAM ++ struct inverted_pam_cookie *pam_cookie; ++#endif /* USE_PAM */ ++#if defined(HAVE_LOGIN_CAP) || defined(LOGIN_ACCESS) ++ const char *from_host, *from_ip; ++ ++ from_host = get_canonical_hostname(options.verify_reverse_mapping); ++ from_ip = get_remote_ipaddr(); ++#endif /* HAVE_LOGIN_CAP || LOGIN_ACCESS */ + + debug("Attempting authentication for %s%.100s.", + authctxt->valid ? "" : "illegal user ", authctxt->user); +@@ -84,7 +96,11 @@ + #if defined(KRB4) || defined(KRB5) + (!options.kerberos_authentication || options.kerberos_or_local_passwd) && + #endif ++#ifdef USE_PAM ++ auth_pam_password(authctxt, "") ++#else + auth_password(authctxt, "")) { ++#endif + auth_log(authctxt, 1, "without authentication", ""); + return; + } +@@ -94,6 +110,8 @@ + packet_send(); + packet_write_wait(); + ++ client_user = NULL; ++ + for (;;) { + /* default to fail */ + authenticated = 0; +@@ -284,6 +302,34 @@ + log("Unknown message during authentication: type %d", type); + break; + } ++ ++#ifdef HAVE_LOGIN_CAP ++ if (pw != NULL) { ++ lc = login_getpwclass(pw); ++ if (lc == NULL) ++ lc = login_getclassbyname(NULL, pw); ++ if (!auth_hostok(lc, from_host, from_ip)) { ++ log("Denied connection for %.200s from %.200s [%.200s].", ++ pw->pw_name, from_host, from_ip); ++ packet_disconnect("Sorry, you are not allowed to connect."); ++ } ++ if (!auth_timeok(lc, time(NULL))) { ++ log("LOGIN %.200s REFUSED (TIME) FROM %.200s", ++ pw->pw_name, from_host); ++ packet_disconnect("Logins not available right now."); ++ } ++ login_close(lc); ++ lc = NULL; ++ } ++#endif /* HAVE_LOGIN_CAP */ ++#ifdef LOGIN_ACCESS ++ if (pw != NULL && !login_access(pw->pw_name, from_host)) { ++ log("Denied connection for %.200s from %.200s [%.200s].", ++ pw->pw_name, from_host, from_ip); ++ packet_disconnect("Sorry, you are not allowed to connect."); ++ } ++#endif /* LOGIN_ACCESS */ ++ + #ifdef BSD_AUTH + if (authctxt->as) { + auth_close(authctxt->as); +@@ -302,6 +348,15 @@ + /* Log before sending the reply */ + auth_log(authctxt, authenticated, get_authname(type), info); + ++#ifdef USE_PAM ++ if (authenticated && !do_pam_account(pw->pw_name, client_user)) ++ authenticated = 0; ++#endif ++ if (client_user != NULL) { ++ xfree(client_user); ++ client_user = NULL; ++ } ++ + if (authenticated) + return; + +@@ -354,6 +409,11 @@ + pw = NULL; + } + authctxt->pw = pw; ++ ++#ifdef USE_PAM ++ if (pw != NULL) ++ start_pam(pw); ++#endif + + setproctitle("%s", pw ? user : "unknown"); + diff --git a/security/openssh/files/patch-auth2.c b/security/openssh/files/patch-auth2.c new file mode 100644 index 000000000000..a7134d573432 --- /dev/null +++ b/security/openssh/files/patch-auth2.c @@ -0,0 +1,98 @@ +--- auth2.c.orig Sun Feb 24 20:14:59 2002 ++++ auth2.c Sun Mar 17 20:15:23 2002 +@@ -166,6 +166,15 @@ + Authmethod *m = NULL; + char *user, *service, *method, *style = NULL; + int authenticated = 0; ++#ifdef HAVE_LOGIN_CAP ++ login_cap_t *lc; ++#endif /* HAVE_LOGIN_CAP */ ++#if defined(HAVE_LOGIN_CAP) || defined(LOGIN_ACCESS) ++ const char *from_host, *from_ip; ++ ++ from_host = get_canonical_hostname(options.verify_reverse_mapping); ++ from_ip = get_remote_ipaddr(); ++#endif /* HAVE_LOGIN_CAP || LOGIN_ACCESS */ + + if (authctxt == NULL) + fatal("input_userauth_request: no authctxt"); +@@ -187,6 +196,11 @@ + authctxt->pw = pwcopy(pw); + authctxt->valid = 1; + debug2("input_userauth_request: setting up authctxt for %s", user); ++ ++#ifdef USE_PAM ++ start_pam(pw); ++#endif ++ + } else { + log("input_userauth_request: illegal user %s", user); + } +@@ -200,6 +214,41 @@ + "(%s,%s) -> (%s,%s)", + authctxt->user, authctxt->service, user, service); + } ++ ++#ifdef HAVE_LOGIN_CAP ++ if (authctxt->pw != NULL) { ++ lc = login_getpwclass(authctxt->pw); ++ if (lc == NULL) ++ lc = login_getclassbyname(NULL, authctxt->pw); ++ if (!auth_hostok(lc, from_host, from_ip)) { ++ log("Denied connection for %.200s from %.200s [%.200s].", ++ authctxt->pw->pw_name, from_host, from_ip); ++ packet_disconnect("Sorry, you are not allowed to connect."); ++ } ++ if (!auth_timeok(lc, time(NULL))) { ++ log("LOGIN %.200s REFUSED (TIME) FROM %.200s", ++ authctxt->pw->pw_name, from_host); ++ packet_disconnect("Logins not available right now."); ++ } ++ login_close(lc); ++ lc = NULL; ++ } ++#endif /* HAVE_LOGIN_CAP */ ++#ifdef LOGIN_ACCESS ++ if (authctxt->pw != NULL && ++ !login_access(authctxt->pw->pw_name, from_host)) { ++ log("Denied connection for %.200s from %.200s [%.200s].", ++ authctxt->pw->pw_name, from_host, from_ip); ++ packet_disconnect("Sorry, you are not allowed to connect."); ++ } ++#endif /* LOGIN_ACCESS */ ++#ifdef BSD_AUTH ++ if (authctxt->as) { ++ auth_close(authctxt->as); ++ authctxt->as = NULL; ++ } ++#endif ++ + /* reset state */ + auth2_challenge_stop(authctxt); + authctxt->postponed = 0; +@@ -210,6 +259,12 @@ + debug2("input_userauth_request: try method %s", method); + authenticated = m->userauth(authctxt); + } ++ ++#ifdef USE_PAM ++ if (authenticated && authctxt->user && !do_pam_account(authctxt->user, NULL)) ++ authenticated = 0; ++#endif /* USE_PAM */ ++ + userauth_finish(authctxt, authenticated, method); + + xfree(service); +@@ -299,7 +354,12 @@ + m->enabled = NULL; + packet_check_eom(); + userauth_banner(); ++ ++#ifdef USE_PAM ++ return authctxt->valid ? auth_pam_password(authctxt, "") : 0; ++#else /* !USE_PAM */ + return authctxt->valid ? auth_password(authctxt, "") : 0; ++#endif /* USE_PAM */ + } + + static int diff --git a/security/openssh/files/patch-session.c b/security/openssh/files/patch-session.c index abb20c8ac770..c2501dd0f071 100644 --- a/security/openssh/files/patch-session.c +++ b/security/openssh/files/patch-session.c @@ -1,6 +1,6 @@ ---- session.c.orig Fri Mar 8 06:11:56 2002 -+++ session.c Fri Mar 8 06:15:32 2002 -@@ -57,6 +57,12 @@ +--- session.c.orig Sun Mar 17 20:08:51 2002 ++++ session.c Sun Mar 17 20:22:06 2002 +@@ -57,6 +57,13 @@ #include "canohost.h" #include "session.h" @@ -8,12 +8,24 @@ +#include <libutil.h> +#include <syslog.h> +#include <time.h> ++#define _PATH_CHPASS "/usr/bin/passwd" +#endif /* __FreeBSD__ */ + /* types */ #define TTYSZ 64 -@@ -394,6 +400,13 @@ +@@ -386,6 +393,10 @@ + if (s == NULL) + fatal("do_exec_no_pty: no session"); + ++#ifdef USE_PAM ++ do_pam_setcred(); ++#endif /* USE_PAM */ ++ + session_proctitle(s); + + /* Fork the child. */ +@@ -394,6 +405,13 @@ log_init(__progname, options.log_level, options.log_facility, log_stderr); /* @@ -27,7 +39,17 @@ * Create a new session and process group since the 4.4BSD * setlogin() affects the entire process group. */ -@@ -499,6 +512,14 @@ +@@ -494,11 +512,24 @@ + ptyfd = s->ptyfd; + ttyfd = s->ttyfd; + ++#ifdef USE_PAM ++ do_pam_session(s->pw->pw_name, s->tty); ++ do_pam_setcred(); ++#endif /* USE_PAM */ ++ + /* Fork the child. */ + if ((pid = fork()) == 0) { /* Child. Reinitialize the log because the pid has changed. */ log_init(__progname, options.log_level, options.log_facility, log_stderr); @@ -42,7 +64,14 @@ /* Close the master side of the pseudo tty. */ close(ptyfd); -@@ -589,6 +610,11 @@ +@@ -583,12 +614,23 @@ + do_login(Session *s, const char *command) + { + char *time_string; ++ char *newcommand; + char hostname[MAXHOSTNAMELEN]; + socklen_t fromlen; + struct sockaddr_storage from; time_t last_login_time; struct passwd * pw = s->pw; pid_t pid = getpid(); @@ -51,15 +80,116 @@ + char buf[256]; + char *fname; +#endif /* HAVE_LOGIN_CAP */ ++#ifdef __FreeBSD__ ++#define DEFAULT_WARN (2L * 7L * 86400L) /* Two weeks */ ++ struct timeval tv; ++ time_t warntime = DEFAULT_WARN; ++#endif /* __FreeBSD__ */ /* * Get IP address of client. If the connection is not a socket, let -@@ -629,6 +655,21 @@ +@@ -616,10 +658,92 @@ + get_remote_name_or_ip(utmp_len, options.verify_reverse_mapping), + (struct sockaddr *)&from); + ++#ifdef USE_PAM ++ /* ++ * If password change is needed, do it now. ++ * This needs to occur before the ~/.hushlogin check. ++ */ ++ if (pam_password_change_required()) { ++ print_pam_messages(); ++ do_pam_chauthtok(); ++ } ++#endif ++ ++#ifdef USE_PAM ++ if (!check_quietlogin(s, command) && !pam_password_change_required()) ++ print_pam_messages(); ++#endif /* USE_PAM */ ++#ifdef __FreeBSD__ ++ if (pw->pw_change || pw->pw_expire) ++ (void)gettimeofday(&tv, NULL); ++#ifdef HAVE_LOGIN_CAP ++ warntime = login_getcaptime(lc, "warnpassword", ++ DEFAULT_WARN, DEFAULT_WARN); ++#endif /* HAVE_LOGIN_CAP */ ++ /* ++ * If the password change time is set and has passed, give the ++ * user a password expiry notice and chance to change it. ++ */ ++ if (pw->pw_change != 0) { ++ if (tv.tv_sec >= pw->pw_change) { ++ (void)printf( ++ "Sorry -- your password has expired.\n"); ++ log("%s Password expired - forcing change", ++ pw->pw_name); ++ if (newcommand != NULL) ++ xfree(newcommand); ++ newcommand = xstrdup(_PATH_CHPASS); ++ } else if (pw->pw_change - tv.tv_sec < warntime && ++ !check_quietlogin(s, command)) ++ (void)printf( ++ "Warning: your password expires on %s", ++ ctime(&pw->pw_change)); ++ } ++#ifndef USE_PAM ++ if (pw->pw_expire) { ++ if (tv.tv_sec >= pw->pw_expire) { ++ (void)printf( ++ "Sorry -- your account has expired.\n"); ++ log( ++ "LOGIN %.200s REFUSED (EXPIRED) FROM %.200s ON TTY %.200s", ++ pw->pw_name, get_remote_name_or_ip(utmp_len, ++ options.verify_reverse_mapping), s->tty); ++ exit(254); ++ } else if (pw->pw_expire - tv.tv_sec < warntime && ++ !check_quietlogin(s, command)) ++ (void)printf( ++ "Warning: your account expires on %s", ++ ctime(&pw->pw_expire)); ++ } ++#endif /* !USE_PAM */ ++#endif /* __FreeBSD__ */ ++ ++#ifdef HAVE_LOGIN_CAP ++ if (!auth_ttyok(lc, s->tty)) { ++ (void)printf("Permission denied.\n"); ++ log( ++ "LOGIN %.200s REFUSED (TTY) FROM %.200s ON TTY %.200s", ++ pw->pw_name, get_remote_name_or_ip(utmp_len, ++ options.verify_reverse_mapping), s->tty); ++ exit(254); ++ } ++#endif /* HAVE_LOGIN_CAP */ ++ + if (check_quietlogin(s, command)) + return; + +- if (options.print_lastlog && last_login_time != 0) { ++ /* ++ * If the user has logged in before, display the time of last ++ * login. However, don't display anything extra if a command ++ * has been specified (so that ssh can be used to execute ++ * commands on a remote machine without users knowing they ++ * are going to another machine). Login(1) will do this for ++ * us as well, so check if login(1) is used ++ */ ++ if (command == NULL && options.print_lastlog && ++ last_login_time != 0 && ++ !options.use_login) { ++ + time_string = ctime(&last_login_time); + if (strchr(time_string, '\n')) + *strchr(time_string, '\n') = 0; +@@ -629,7 +753,30 @@ printf("Last login: %s from %s\r\n", time_string, hostname); } +- do_motd(); +#ifdef HAVE_LOGIN_CAP -+ if (!options.use_login) { ++ if (command == NULL && ++ !options.use_login) { + fname = login_getcapstr(lc, "copyright", NULL, NULL); + if (fname != NULL && (f = fopen(fname, "r")) != NULL) { + while (fgets(buf, sizeof(buf), f) != NULL) @@ -73,10 +203,43 @@ + } +#endif /* HAVE_LOGIN_CAP */ + - do_motd(); ++ /* ++ * Print /etc/motd unless a command was specified or printing ++ * it was disabled in server options or login(1) will be ++ * used. Note that some machines appear to print it in ++ * /etc/profile or similar. ++ */ ++ if (command == NULL && !options.use_login) ++ do_motd(); } -@@ -775,6 +816,10 @@ + /* +@@ -645,9 +792,9 @@ + #ifdef HAVE_LOGIN_CAP + f = fopen(login_getcapstr(lc, "welcome", "/etc/motd", + "/etc/motd"), "r"); +-#else ++#else /* !HAVE_LOGIN_CAP */ + f = fopen("/etc/motd", "r"); +-#endif ++#endif /* HAVE_LOGIN_CAP */ + if (f) { + while (fgets(buf, sizeof(buf), f)) + fputs(buf, stdout); +@@ -674,10 +821,10 @@ + #ifdef HAVE_LOGIN_CAP + if (login_getcapbool(lc, "hushlogin", 0) || stat(buf, &st) >= 0) + return 1; +-#else ++#else /* HAVE_LOGIN_CAP */ + if (stat(buf, &st) >= 0) + return 1; +-#endif ++#endif /* HAVE_LOGIN_CAP */ + return 0; + } + +@@ -775,6 +922,10 @@ env[0] = NULL; if (!options.use_login) { @@ -87,34 +250,74 @@ /* Set basic environment. */ child_set_env(&env, &envsize, "USER", pw->pw_name); child_set_env(&env, &envsize, "LOGNAME", pw->pw_name); -@@ -782,6 +827,12 @@ +@@ -782,9 +933,15 @@ #ifdef HAVE_LOGIN_CAP (void) setusercontext(lc, pw, pw->pw_uid, LOGIN_SETPATH); child_set_env(&env, &envsize, "PATH", getenv("PATH")); +-#else + var= login_getcapstr(lc, "lang", NULL, NULL); + if ( var ) child_set_env(&env, &envsize, "LANG", var); + var= login_getcapstr(lc, "charset", NULL, NULL); + if ( var ) child_set_env(&env, &envsize, "MM_CHARSET", var); + var= login_getcapstr(lc, "timezone", NULL, NULL); + if ( var ) child_set_env(&env, &envsize, "TZ", var); - #else ++#else /* !HAVE_LOGIN_CAP */ child_set_env(&env, &envsize, "PATH", _PATH_STDPATH); - #endif -@@ -793,8 +844,13 @@ - /* Normal systems set SHELL by default. */ - child_set_env(&env, &envsize, "SHELL", shell); - } -+#ifdef HAVE_LOGIN_CAP -+#else /* HAVE_LOGIN_CAP */ -+ if (getenv("TZ")) -+ child_set_env(&env, &envsize, "TZ", getenv("TZ")); - if (getenv("TZ")) - child_set_env(&env, &envsize, "TZ", getenv("TZ")); +-#endif +#endif /* HAVE_LOGIN_CAP */ - /* Set custom environment options from RSA authentication. */ - if (!options.use_login) { -@@ -1057,7 +1113,7 @@ + snprintf(buf, sizeof buf, "%.200s/%.50s", + _PATH_MAILDIR, pw->pw_name); +@@ -837,6 +994,11 @@ + child_set_env(&env, &envsize, "KRB5CCNAME", + s->authctxt->krb5_ticket_file); + #endif ++#ifdef USE_PAM ++ /* Pull in any environment variables that may have been set by PAM. */ ++ do_pam_environment(&env, &envsize); ++#endif /* USE_PAM */ ++ + if (auth_get_socket_name() != NULL) + child_set_env(&env, &envsize, SSH_AUTHSOCKET_ENV_NAME, + auth_get_socket_name()); +@@ -979,6 +1141,36 @@ + fatal("Failed to set uids to %u.", (u_int) pw->pw_uid); + } + ++#ifdef USE_PAM ++/* ++ * Sets any environment variables which have been specified by PAM ++ */ ++void do_pam_environment(char ***env, int *envsize) ++{ ++ char *equals, var_name[512], var_val[512]; ++ char **pam_env; ++ int i; ++ ++ if ((pam_env = fetch_pam_environment()) == NULL) ++ return; ++ ++ for(i = 0; pam_env[i] != NULL; i++) { ++ if ((equals = strstr(pam_env[i], "=")) == NULL) ++ continue; ++ ++ if (strlen(pam_env[i]) < (sizeof(var_name) - 1)) { ++ memset(var_name, '\0', sizeof(var_name)); ++ memset(var_val, '\0', sizeof(var_val)); ++ ++ strncpy(var_name, pam_env[i], equals - pam_env[i]); ++ strcpy(var_val, equals + 1); ++ ++ child_set_env(env, envsize, var_name, var_val); ++ } ++ } ++} ++#endif /* USE_PAM */ ++ + /* + * Performs common processing for the child, such as setting up the + * environment, closing extra file descriptors, setting the user and group +@@ -1057,7 +1249,7 @@ * initgroups, because at least on Solaris 2.3 it leaves file * descriptors open. */ @@ -123,7 +326,7 @@ close(i); /* -@@ -1087,6 +1143,31 @@ +@@ -1087,6 +1279,31 @@ exit(1); #endif } diff --git a/security/openssh/files/patch-ssh-Makefile b/security/openssh/files/patch-ssh-Makefile index 6971b0cfacf1..d988af43f124 100644 --- a/security/openssh/files/patch-ssh-Makefile +++ b/security/openssh/files/patch-ssh-Makefile @@ -1,5 +1,5 @@ ---- ssh/Makefile.orig Tue Sep 11 00:44:47 2001 -+++ ssh/Makefile Wed Oct 3 13:54:47 2001 +--- ssh/Makefile.orig Tue Mar 5 01:49:51 2002 ++++ ssh/Makefile Sun Mar 17 14:58:13 2002 @@ -7,8 +7,8 @@ BINMODE?=4555 @@ -34,7 +34,7 @@ .include <bsd.prog.mk> --LDADD+= -lcrypto -lz +-LDADD+= -lcrypto -lz -ldes -DPADD+= ${LIBCRYPTO} ${LIBZ} +LDADD+= ${CRYPTOLIBS} -lcrypt -lutil -lz +DPADD+= ${LIBCRYPTO} ${LIBUTIL} ${LIBZ} diff --git a/security/openssh/files/patch-ssh-keyscan-Makefile b/security/openssh/files/patch-ssh-keyscan-Makefile index d31653ac8736..5a4f3d6388e8 100644 --- a/security/openssh/files/patch-ssh-keyscan-Makefile +++ b/security/openssh/files/patch-ssh-keyscan-Makefile @@ -1,5 +1,5 @@ ---- ssh-keyscan/Makefile.orig Sun Mar 4 08:59:39 2001 -+++ ssh-keyscan/Makefile Thu Jul 12 18:57:39 2001 +--- ssh-keyscan/Makefile.orig Mon Aug 6 01:18:20 2001 ++++ ssh-keyscan/Makefile Sun Mar 17 14:58:13 2002 @@ -7,12 +7,13 @@ BINMODE?=555 @@ -14,6 +14,6 @@ .include <bsd.prog.mk> +.include "Makefile.inc" --LDADD+= -lcrypto +-LDADD+= -lcrypto -lz +LDADD+= ${CRYPTOLIBS} -lutil -lz - DPADD+= ${LIBCRYPTO} + DPADD+= ${LIBCRYPTO} ${LIBZ} diff --git a/security/openssh/files/sshd.sh b/security/openssh/files/sshd.sh index 74798cff8d6f..ba52de02fe7b 100644 --- a/security/openssh/files/sshd.sh +++ b/security/openssh/files/sshd.sh @@ -1,27 +1,24 @@ #!/bin/sh case "$1" in - start) - __PREFIX__/sbin/sshd +start) + __PREFIX__/sbin/sshd + echo -n ' sshd' + ;; +stop) + if [ -f /var/run/sshd.pid ]; then + kill -TERM `cat /var/run/sshd.pid` + rm -f /var/run/sshd.pid echo -n ' sshd' - ;; - stop) - if [ -f /var/run/sshd.pid ]; then - kill -TERM `cat /var/run/sshd.pid` - rm -f /var/run/sshd.pid - echo -n ' sshd' - fi - ;; - restart) - if [ -f /var/run/sshd.pid ]; then - kill -HUP `cat /var/run/sshd.pid` - echo 'sshd restarted' - fi - ;; - -h) - echo "Usage: `basename $0` { start | stop | restart }" - ;; - *) - __PREFIX__/sbin/sshd - echo -n ' sshd' - ;; + fi + ;; +restart) + if [ -f /var/run/sshd.pid ]; then + kill -HUP `cat /var/run/sshd.pid` + echo 'sshd restarted' + fi + ;; +*) + echo "Usage: ${0##*/}: { start | stop | restart }" 2>&1 + exit 65 + ;; esac |