diff options
author | Darren Tucker <dtucker@zip.com.au> | 2003-08-13 20:37:05 +1000 |
---|---|---|
committer | Darren Tucker <dtucker@zip.com.au> | 2003-08-13 20:37:05 +1000 |
commit | ec960f2c933aa55ca5dc319cff55cecce34f1f4b (patch) | |
tree | 9b684c910ef3e2fc2253003c6353334969405871 | |
parent | 3bdbd848ea86c27a65ee766fd2c9d9158dadb381 (diff) |
- markus@cvs.openbsd.org 2003/08/13 08:46:31
[auth1.c readconf.c readconf.h servconf.c servconf.h ssh.c ssh_config
ssh_config.5 sshconnect1.c sshd.8 sshd.c sshd_config sshd_config.5]
remove RhostsAuthentication; suggested by djm@ before; ok djm@, deraadt@,
fgsch@, miod@, henning@, jakob@ and others
-rw-r--r-- | ChangeLog | 7 | ||||
-rw-r--r-- | auth1.c | 22 | ||||
-rw-r--r-- | readconf.c | 15 | ||||
-rw-r--r-- | readconf.h | 3 | ||||
-rw-r--r-- | servconf.c | 13 | ||||
-rw-r--r-- | servconf.h | 4 | ||||
-rw-r--r-- | ssh.c | 14 | ||||
-rw-r--r-- | ssh_config | 3 | ||||
-rw-r--r-- | ssh_config.5 | 28 | ||||
-rw-r--r-- | sshconnect1.c | 22 | ||||
-rw-r--r-- | sshd.8 | 3 | ||||
-rw-r--r-- | sshd.c | 19 | ||||
-rw-r--r-- | sshd_config | 8 | ||||
-rw-r--r-- | sshd_config.5 | 7 |
14 files changed, 28 insertions, 140 deletions
@@ -5,6 +5,11 @@ | |||
5 | [session.c] | 5 | [session.c] |
6 | use more portable tcsendbreak(3) and ignore break_length; | 6 | use more portable tcsendbreak(3) and ignore break_length; |
7 | ok deraadt, millert | 7 | ok deraadt, millert |
8 | - markus@cvs.openbsd.org 2003/08/13 08:46:31 | ||
9 | [auth1.c readconf.c readconf.h servconf.c servconf.h ssh.c ssh_config | ||
10 | ssh_config.5 sshconnect1.c sshd.8 sshd.c sshd_config sshd_config.5] | ||
11 | remove RhostsAuthentication; suggested by djm@ before; ok djm@, deraadt@, | ||
12 | fgsch@, miod@, henning@, jakob@ and others | ||
8 | 13 | ||
9 | 20030811 | 14 | 20030811 |
10 | - (dtucker) OpenBSD CVS Sync | 15 | - (dtucker) OpenBSD CVS Sync |
@@ -823,4 +828,4 @@ | |||
823 | - Fix sshd BindAddress and -b options for systems using fake-getaddrinfo. | 828 | - Fix sshd BindAddress and -b options for systems using fake-getaddrinfo. |
824 | Report from murple@murple.net, diagnosis from dtucker@zip.com.au | 829 | Report from murple@murple.net, diagnosis from dtucker@zip.com.au |
825 | 830 | ||
826 | $Id: ChangeLog,v 1.2890 2003/08/13 10:31:05 dtucker Exp $ | 831 | $Id: ChangeLog,v 1.2891 2003/08/13 10:37:05 dtucker Exp $ |
@@ -10,7 +10,7 @@ | |||
10 | */ | 10 | */ |
11 | 11 | ||
12 | #include "includes.h" | 12 | #include "includes.h" |
13 | RCSID("$OpenBSD: auth1.c,v 1.49 2003/07/22 13:35:22 markus Exp $"); | 13 | RCSID("$OpenBSD: auth1.c,v 1.50 2003/08/13 08:46:30 markus Exp $"); |
14 | 14 | ||
15 | #include "xmalloc.h" | 15 | #include "xmalloc.h" |
16 | #include "rsa.h" | 16 | #include "rsa.h" |
@@ -160,26 +160,6 @@ do_authloop(Authctxt *authctxt) | |||
160 | break; | 160 | break; |
161 | #endif | 161 | #endif |
162 | 162 | ||
163 | case SSH_CMSG_AUTH_RHOSTS: | ||
164 | if (!options.rhosts_authentication) { | ||
165 | verbose("Rhosts authentication disabled."); | ||
166 | break; | ||
167 | } | ||
168 | /* | ||
169 | * Get client user name. Note that we just have to | ||
170 | * trust the client; this is one reason why rhosts | ||
171 | * authentication is insecure. (Another is | ||
172 | * IP-spoofing on a local network.) | ||
173 | */ | ||
174 | client_user = packet_get_string(&ulen); | ||
175 | packet_check_eom(); | ||
176 | |||
177 | /* Try to authenticate using /etc/hosts.equiv and .rhosts. */ | ||
178 | authenticated = auth_rhosts(pw, client_user); | ||
179 | |||
180 | snprintf(info, sizeof info, " ruser %.100s", client_user); | ||
181 | break; | ||
182 | |||
183 | case SSH_CMSG_AUTH_RHOSTS_RSA: | 163 | case SSH_CMSG_AUTH_RHOSTS_RSA: |
184 | if (!options.rhosts_rsa_authentication) { | 164 | if (!options.rhosts_rsa_authentication) { |
185 | verbose("Rhosts with RSA authentication disabled."); | 165 | verbose("Rhosts with RSA authentication disabled."); |
diff --git a/readconf.c b/readconf.c index 332500e7c..355a7dfcc 100644 --- a/readconf.c +++ b/readconf.c | |||
@@ -12,7 +12,7 @@ | |||
12 | */ | 12 | */ |
13 | 13 | ||
14 | #include "includes.h" | 14 | #include "includes.h" |
15 | RCSID("$OpenBSD: readconf.c,v 1.115 2003/07/22 13:35:22 markus Exp $"); | 15 | RCSID("$OpenBSD: readconf.c,v 1.116 2003/08/13 08:46:30 markus Exp $"); |
16 | 16 | ||
17 | #include "ssh.h" | 17 | #include "ssh.h" |
18 | #include "xmalloc.h" | 18 | #include "xmalloc.h" |
@@ -57,7 +57,6 @@ RCSID("$OpenBSD: readconf.c,v 1.115 2003/07/22 13:35:22 markus Exp $"); | |||
57 | Host fascist.blob.com | 57 | Host fascist.blob.com |
58 | Port 23123 | 58 | Port 23123 |
59 | User tylonen | 59 | User tylonen |
60 | RhostsAuthentication no | ||
61 | PasswordAuthentication no | 60 | PasswordAuthentication no |
62 | 61 | ||
63 | Host puukko.hut.fi | 62 | Host puukko.hut.fi |
@@ -75,7 +74,6 @@ RCSID("$OpenBSD: readconf.c,v 1.115 2003/07/22 13:35:22 markus Exp $"); | |||
75 | Host * | 74 | Host * |
76 | ForwardAgent no | 75 | ForwardAgent no |
77 | ForwardX11 no | 76 | ForwardX11 no |
78 | RhostsAuthentication yes | ||
79 | PasswordAuthentication yes | 77 | PasswordAuthentication yes |
80 | RSAAuthentication yes | 78 | RSAAuthentication yes |
81 | RhostsRSAAuthentication yes | 79 | RhostsRSAAuthentication yes |
@@ -91,7 +89,7 @@ RCSID("$OpenBSD: readconf.c,v 1.115 2003/07/22 13:35:22 markus Exp $"); | |||
91 | 89 | ||
92 | typedef enum { | 90 | typedef enum { |
93 | oBadOption, | 91 | oBadOption, |
94 | oForwardAgent, oForwardX11, oGatewayPorts, oRhostsAuthentication, | 92 | oForwardAgent, oForwardX11, oGatewayPorts, |
95 | oPasswordAuthentication, oRSAAuthentication, | 93 | oPasswordAuthentication, oRSAAuthentication, |
96 | oChallengeResponseAuthentication, oXAuthLocation, | 94 | oChallengeResponseAuthentication, oXAuthLocation, |
97 | oKerberosAuthentication, oKerberosTgtPassing, | 95 | oKerberosAuthentication, oKerberosTgtPassing, |
@@ -122,7 +120,7 @@ static struct { | |||
122 | { "xauthlocation", oXAuthLocation }, | 120 | { "xauthlocation", oXAuthLocation }, |
123 | { "gatewayports", oGatewayPorts }, | 121 | { "gatewayports", oGatewayPorts }, |
124 | { "useprivilegedport", oUsePrivilegedPort }, | 122 | { "useprivilegedport", oUsePrivilegedPort }, |
125 | { "rhostsauthentication", oRhostsAuthentication }, | 123 | { "rhostsauthentication", oDeprecated }, |
126 | { "passwordauthentication", oPasswordAuthentication }, | 124 | { "passwordauthentication", oPasswordAuthentication }, |
127 | { "kbdinteractiveauthentication", oKbdInteractiveAuthentication }, | 125 | { "kbdinteractiveauthentication", oKbdInteractiveAuthentication }, |
128 | { "kbdinteractivedevices", oKbdInteractiveDevices }, | 126 | { "kbdinteractivedevices", oKbdInteractiveDevices }, |
@@ -351,10 +349,6 @@ parse_flag: | |||
351 | intptr = &options->use_privileged_port; | 349 | intptr = &options->use_privileged_port; |
352 | goto parse_flag; | 350 | goto parse_flag; |
353 | 351 | ||
354 | case oRhostsAuthentication: | ||
355 | intptr = &options->rhosts_authentication; | ||
356 | goto parse_flag; | ||
357 | |||
358 | case oPasswordAuthentication: | 352 | case oPasswordAuthentication: |
359 | intptr = &options->password_authentication; | 353 | intptr = &options->password_authentication; |
360 | goto parse_flag; | 354 | goto parse_flag; |
@@ -814,7 +808,6 @@ initialize_options(Options * options) | |||
814 | options->xauth_location = NULL; | 808 | options->xauth_location = NULL; |
815 | options->gateway_ports = -1; | 809 | options->gateway_ports = -1; |
816 | options->use_privileged_port = -1; | 810 | options->use_privileged_port = -1; |
817 | options->rhosts_authentication = -1; | ||
818 | options->rsa_authentication = -1; | 811 | options->rsa_authentication = -1; |
819 | options->pubkey_authentication = -1; | 812 | options->pubkey_authentication = -1; |
820 | options->challenge_response_authentication = -1; | 813 | options->challenge_response_authentication = -1; |
@@ -884,8 +877,6 @@ fill_default_options(Options * options) | |||
884 | options->gateway_ports = 0; | 877 | options->gateway_ports = 0; |
885 | if (options->use_privileged_port == -1) | 878 | if (options->use_privileged_port == -1) |
886 | options->use_privileged_port = 0; | 879 | options->use_privileged_port = 0; |
887 | if (options->rhosts_authentication == -1) | ||
888 | options->rhosts_authentication = 0; | ||
889 | if (options->rsa_authentication == -1) | 880 | if (options->rsa_authentication == -1) |
890 | options->rsa_authentication = 1; | 881 | options->rsa_authentication = 1; |
891 | if (options->pubkey_authentication == -1) | 882 | if (options->pubkey_authentication == -1) |
diff --git a/readconf.h b/readconf.h index cc94253e6..6fbf467e5 100644 --- a/readconf.h +++ b/readconf.h | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: readconf.h,v 1.52 2003/07/22 13:35:22 markus Exp $ */ | 1 | /* $OpenBSD: readconf.h,v 1.53 2003/08/13 08:46:30 markus Exp $ */ |
2 | 2 | ||
3 | /* | 3 | /* |
4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
@@ -33,7 +33,6 @@ typedef struct { | |||
33 | char *xauth_location; /* Location for xauth program */ | 33 | char *xauth_location; /* Location for xauth program */ |
34 | int gateway_ports; /* Allow remote connects to forwarded ports. */ | 34 | int gateway_ports; /* Allow remote connects to forwarded ports. */ |
35 | int use_privileged_port; /* Don't use privileged port if false. */ | 35 | int use_privileged_port; /* Don't use privileged port if false. */ |
36 | int rhosts_authentication; /* Try rhosts authentication. */ | ||
37 | int rhosts_rsa_authentication; /* Try rhosts with RSA | 36 | int rhosts_rsa_authentication; /* Try rhosts with RSA |
38 | * authentication. */ | 37 | * authentication. */ |
39 | int rsa_authentication; /* Try RSA authentication. */ | 38 | int rsa_authentication; /* Try RSA authentication. */ |
diff --git a/servconf.c b/servconf.c index c4b2bb284..e9c313bbb 100644 --- a/servconf.c +++ b/servconf.c | |||
@@ -10,7 +10,7 @@ | |||
10 | */ | 10 | */ |
11 | 11 | ||
12 | #include "includes.h" | 12 | #include "includes.h" |
13 | RCSID("$OpenBSD: servconf.c,v 1.123 2003/07/22 13:35:22 markus Exp $"); | 13 | RCSID("$OpenBSD: servconf.c,v 1.124 2003/08/13 08:46:30 markus Exp $"); |
14 | 14 | ||
15 | #include "ssh.h" | 15 | #include "ssh.h" |
16 | #include "log.h" | 16 | #include "log.h" |
@@ -64,7 +64,6 @@ initialize_server_options(ServerOptions *options) | |||
64 | options->keepalives = -1; | 64 | options->keepalives = -1; |
65 | options->log_facility = SYSLOG_FACILITY_NOT_SET; | 65 | options->log_facility = SYSLOG_FACILITY_NOT_SET; |
66 | options->log_level = SYSLOG_LEVEL_NOT_SET; | 66 | options->log_level = SYSLOG_LEVEL_NOT_SET; |
67 | options->rhosts_authentication = -1; | ||
68 | options->rhosts_rsa_authentication = -1; | 67 | options->rhosts_rsa_authentication = -1; |
69 | options->hostbased_authentication = -1; | 68 | options->hostbased_authentication = -1; |
70 | options->hostbased_uses_name_from_packet_only = -1; | 69 | options->hostbased_uses_name_from_packet_only = -1; |
@@ -165,8 +164,6 @@ fill_default_server_options(ServerOptions *options) | |||
165 | options->log_facility = SYSLOG_FACILITY_AUTH; | 164 | options->log_facility = SYSLOG_FACILITY_AUTH; |
166 | if (options->log_level == SYSLOG_LEVEL_NOT_SET) | 165 | if (options->log_level == SYSLOG_LEVEL_NOT_SET) |
167 | options->log_level = SYSLOG_LEVEL_INFO; | 166 | options->log_level = SYSLOG_LEVEL_INFO; |
168 | if (options->rhosts_authentication == -1) | ||
169 | options->rhosts_authentication = 0; | ||
170 | if (options->rhosts_rsa_authentication == -1) | 167 | if (options->rhosts_rsa_authentication == -1) |
171 | options->rhosts_rsa_authentication = 0; | 168 | options->rhosts_rsa_authentication = 0; |
172 | if (options->hostbased_authentication == -1) | 169 | if (options->hostbased_authentication == -1) |
@@ -248,7 +245,7 @@ typedef enum { | |||
248 | /* Standard Options */ | 245 | /* Standard Options */ |
249 | sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime, sKeyRegenerationTime, | 246 | sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime, sKeyRegenerationTime, |
250 | sPermitRootLogin, sLogFacility, sLogLevel, | 247 | sPermitRootLogin, sLogFacility, sLogLevel, |
251 | sRhostsAuthentication, sRhostsRSAAuthentication, sRSAAuthentication, | 248 | sRhostsRSAAuthentication, sRSAAuthentication, |
252 | sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup, | 249 | sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup, |
253 | sKerberosTgtPassing, sChallengeResponseAuthentication, | 250 | sKerberosTgtPassing, sChallengeResponseAuthentication, |
254 | sPasswordAuthentication, sKbdInteractiveAuthentication, sListenAddress, | 251 | sPasswordAuthentication, sKbdInteractiveAuthentication, sListenAddress, |
@@ -288,7 +285,7 @@ static struct { | |||
288 | { "permitrootlogin", sPermitRootLogin }, | 285 | { "permitrootlogin", sPermitRootLogin }, |
289 | { "syslogfacility", sLogFacility }, | 286 | { "syslogfacility", sLogFacility }, |
290 | { "loglevel", sLogLevel }, | 287 | { "loglevel", sLogLevel }, |
291 | { "rhostsauthentication", sRhostsAuthentication }, | 288 | { "rhostsauthentication", sDeprecated }, |
292 | { "rhostsrsaauthentication", sRhostsRSAAuthentication }, | 289 | { "rhostsrsaauthentication", sRhostsRSAAuthentication }, |
293 | { "hostbasedauthentication", sHostbasedAuthentication }, | 290 | { "hostbasedauthentication", sHostbasedAuthentication }, |
294 | { "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly }, | 291 | { "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly }, |
@@ -589,10 +586,6 @@ parse_flag: | |||
589 | intptr = &options->ignore_user_known_hosts; | 586 | intptr = &options->ignore_user_known_hosts; |
590 | goto parse_flag; | 587 | goto parse_flag; |
591 | 588 | ||
592 | case sRhostsAuthentication: | ||
593 | intptr = &options->rhosts_authentication; | ||
594 | goto parse_flag; | ||
595 | |||
596 | case sRhostsRSAAuthentication: | 589 | case sRhostsRSAAuthentication: |
597 | intptr = &options->rhosts_rsa_authentication; | 590 | intptr = &options->rhosts_rsa_authentication; |
598 | goto parse_flag; | 591 | goto parse_flag; |
diff --git a/servconf.h b/servconf.h index 65ad2071a..42bcda757 100644 --- a/servconf.h +++ b/servconf.h | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: servconf.h,v 1.62 2003/07/22 13:35:22 markus Exp $ */ | 1 | /* $OpenBSD: servconf.h,v 1.63 2003/08/13 08:46:30 markus Exp $ */ |
2 | 2 | ||
3 | /* | 3 | /* |
4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
@@ -65,8 +65,6 @@ typedef struct { | |||
65 | int gateway_ports; /* If true, allow remote connects to forwarded ports. */ | 65 | int gateway_ports; /* If true, allow remote connects to forwarded ports. */ |
66 | SyslogFacility log_facility; /* Facility for system logging. */ | 66 | SyslogFacility log_facility; /* Facility for system logging. */ |
67 | LogLevel log_level; /* Level for system logging. */ | 67 | LogLevel log_level; /* Level for system logging. */ |
68 | int rhosts_authentication; /* If true, permit rhosts | ||
69 | * authentication. */ | ||
70 | int rhosts_rsa_authentication; /* If true, permit rhosts RSA | 68 | int rhosts_rsa_authentication; /* If true, permit rhosts RSA |
71 | * authentication. */ | 69 | * authentication. */ |
72 | int hostbased_authentication; /* If true, permit ssh2 hostbased auth */ | 70 | int hostbased_authentication; /* If true, permit ssh2 hostbased auth */ |
@@ -40,7 +40,7 @@ | |||
40 | */ | 40 | */ |
41 | 41 | ||
42 | #include "includes.h" | 42 | #include "includes.h" |
43 | RCSID("$OpenBSD: ssh.c,v 1.198 2003/07/22 13:35:22 markus Exp $"); | 43 | RCSID("$OpenBSD: ssh.c,v 1.199 2003/08/13 08:46:30 markus Exp $"); |
44 | 44 | ||
45 | #include <openssl/evp.h> | 45 | #include <openssl/evp.h> |
46 | #include <openssl/err.h> | 46 | #include <openssl/err.h> |
@@ -600,19 +600,7 @@ again: | |||
600 | strcmp(options.proxy_command, "none") == 0) | 600 | strcmp(options.proxy_command, "none") == 0) |
601 | options.proxy_command = NULL; | 601 | options.proxy_command = NULL; |
602 | 602 | ||
603 | /* Disable rhosts authentication if not running as root. */ | ||
604 | #ifdef HAVE_CYGWIN | ||
605 | /* Ignore uid if running under Windows */ | ||
606 | if (!options.use_privileged_port) { | ||
607 | #else | ||
608 | if (original_effective_uid != 0 || !options.use_privileged_port) { | ||
609 | #endif | ||
610 | debug("Rhosts Authentication disabled, " | ||
611 | "originating port will not be trusted."); | ||
612 | options.rhosts_authentication = 0; | ||
613 | } | ||
614 | /* Open a connection to the remote host. */ | 603 | /* Open a connection to the remote host. */ |
615 | |||
616 | if (ssh_connect(host, &hostaddr, options.port, | 604 | if (ssh_connect(host, &hostaddr, options.port, |
617 | options.address_family, options.connection_attempts, | 605 | options.address_family, options.connection_attempts, |
618 | #ifdef HAVE_CYGWIN | 606 | #ifdef HAVE_CYGWIN |
diff --git a/ssh_config b/ssh_config index 721e374e0..2692e8913 100644 --- a/ssh_config +++ b/ssh_config | |||
@@ -1,4 +1,4 @@ | |||
1 | # $OpenBSD: ssh_config,v 1.18 2003/05/16 03:27:12 djm Exp $ | 1 | # $OpenBSD: ssh_config,v 1.19 2003/08/13 08:46:31 markus Exp $ |
2 | 2 | ||
3 | # This is the ssh client system-wide configuration file. See | 3 | # This is the ssh client system-wide configuration file. See |
4 | # ssh_config(5) for more information. This file provides defaults for | 4 | # ssh_config(5) for more information. This file provides defaults for |
@@ -18,7 +18,6 @@ | |||
18 | # Host * | 18 | # Host * |
19 | # ForwardAgent no | 19 | # ForwardAgent no |
20 | # ForwardX11 no | 20 | # ForwardX11 no |
21 | # RhostsAuthentication no | ||
22 | # RhostsRSAAuthentication no | 21 | # RhostsRSAAuthentication no |
23 | # RSAAuthentication yes | 22 | # RSAAuthentication yes |
24 | # PasswordAuthentication yes | 23 | # PasswordAuthentication yes |
diff --git a/ssh_config.5 b/ssh_config.5 index 3a79af8f0..fb341d79b 100644 --- a/ssh_config.5 +++ b/ssh_config.5 | |||
@@ -34,7 +34,7 @@ | |||
34 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | 34 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
35 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | 35 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
36 | .\" | 36 | .\" |
37 | .\" $OpenBSD: ssh_config.5,v 1.16 2003/07/22 13:35:22 markus Exp $ | 37 | .\" $OpenBSD: ssh_config.5,v 1.17 2003/08/13 08:46:31 markus Exp $ |
38 | .Dd September 25, 1999 | 38 | .Dd September 25, 1999 |
39 | .Dt SSH_CONFIG 5 | 39 | .Dt SSH_CONFIG 5 |
40 | .Os | 40 | .Os |
@@ -529,26 +529,6 @@ IPv6 addresses can be specified with an alternative syntax: | |||
529 | Multiple forwardings may be specified, and additional | 529 | Multiple forwardings may be specified, and additional |
530 | forwardings can be given on the command line. | 530 | forwardings can be given on the command line. |
531 | Only the superuser can forward privileged ports. | 531 | Only the superuser can forward privileged ports. |
532 | .It Cm RhostsAuthentication | ||
533 | Specifies whether to try rhosts based authentication. | ||
534 | Note that this | ||
535 | declaration only affects the client side and has no effect whatsoever | ||
536 | on security. | ||
537 | Most servers do not permit RhostsAuthentication because it | ||
538 | is not secure (see | ||
539 | .Cm RhostsRSAAuthentication ) . | ||
540 | The argument to this keyword must be | ||
541 | .Dq yes | ||
542 | or | ||
543 | .Dq no . | ||
544 | The default is | ||
545 | .Dq no . | ||
546 | This option applies to protocol version 1 only and requires | ||
547 | .Nm ssh | ||
548 | to be setuid root and | ||
549 | .Cm UsePrivilegedPort | ||
550 | to be set to | ||
551 | .Dq yes . | ||
552 | .It Cm RhostsRSAAuthentication | 532 | .It Cm RhostsRSAAuthentication |
553 | Specifies whether to try rhosts based authentication with RSA host | 533 | Specifies whether to try rhosts based authentication with RSA host |
554 | authentication. | 534 | authentication. |
@@ -629,11 +609,9 @@ If set to | |||
629 | must be setuid root. | 609 | must be setuid root. |
630 | Note that this option must be set to | 610 | Note that this option must be set to |
631 | .Dq yes | 611 | .Dq yes |
632 | if | 612 | for |
633 | .Cm RhostsAuthentication | ||
634 | and | ||
635 | .Cm RhostsRSAAuthentication | 613 | .Cm RhostsRSAAuthentication |
636 | authentications are needed with older servers. | 614 | with older servers. |
637 | .It Cm User | 615 | .It Cm User |
638 | Specifies the user to log in as. | 616 | Specifies the user to log in as. |
639 | This can be useful when a different user name is used on different machines. | 617 | This can be useful when a different user name is used on different machines. |
diff --git a/sshconnect1.c b/sshconnect1.c index 8851c35f6..5e1802b10 100644 --- a/sshconnect1.c +++ b/sshconnect1.c | |||
@@ -13,7 +13,7 @@ | |||
13 | */ | 13 | */ |
14 | 14 | ||
15 | #include "includes.h" | 15 | #include "includes.h" |
16 | RCSID("$OpenBSD: sshconnect1.c,v 1.54 2003/07/22 13:35:22 markus Exp $"); | 16 | RCSID("$OpenBSD: sshconnect1.c,v 1.55 2003/08/13 08:46:31 markus Exp $"); |
17 | 17 | ||
18 | #include <openssl/bn.h> | 18 | #include <openssl/bn.h> |
19 | #include <openssl/md5.h> | 19 | #include <openssl/md5.h> |
@@ -932,26 +932,6 @@ ssh_userauth1(const char *local_user, const char *server_user, char *host, | |||
932 | #endif /* KRB5 */ | 932 | #endif /* KRB5 */ |
933 | 933 | ||
934 | /* | 934 | /* |
935 | * Use rhosts authentication if running in privileged socket and we | ||
936 | * do not wish to remain anonymous. | ||
937 | */ | ||
938 | if ((supported_authentications & (1 << SSH_AUTH_RHOSTS)) && | ||
939 | options.rhosts_authentication) { | ||
940 | debug("Trying rhosts authentication."); | ||
941 | packet_start(SSH_CMSG_AUTH_RHOSTS); | ||
942 | packet_put_cstring(local_user); | ||
943 | packet_send(); | ||
944 | packet_write_wait(); | ||
945 | |||
946 | /* The server should respond with success or failure. */ | ||
947 | type = packet_read(); | ||
948 | if (type == SSH_SMSG_SUCCESS) | ||
949 | goto success; | ||
950 | if (type != SSH_SMSG_FAILURE) | ||
951 | packet_disconnect("Protocol error: got %d in response to rhosts auth", | ||
952 | type); | ||
953 | } | ||
954 | /* | ||
955 | * Try .rhosts or /etc/hosts.equiv authentication with RSA host | 935 | * Try .rhosts or /etc/hosts.equiv authentication with RSA host |
956 | * authentication. | 936 | * authentication. |
957 | */ | 937 | */ |
@@ -34,7 +34,7 @@ | |||
34 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | 34 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
35 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | 35 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
36 | .\" | 36 | .\" |
37 | .\" $OpenBSD: sshd.8,v 1.198 2003/06/10 09:12:12 jmc Exp $ | 37 | .\" $OpenBSD: sshd.8,v 1.199 2003/08/13 08:46:31 markus Exp $ |
38 | .Dd September 25, 1999 | 38 | .Dd September 25, 1999 |
39 | .Dt SSHD 8 | 39 | .Dt SSHD 8 |
40 | .Os | 40 | .Os |
@@ -292,7 +292,6 @@ may also be used to prevent | |||
292 | from making DNS requests unless the authentication | 292 | from making DNS requests unless the authentication |
293 | mechanism or configuration requires it. | 293 | mechanism or configuration requires it. |
294 | Authentication mechanisms that may require DNS include | 294 | Authentication mechanisms that may require DNS include |
295 | .Cm RhostsAuthentication , | ||
296 | .Cm RhostsRSAAuthentication , | 295 | .Cm RhostsRSAAuthentication , |
297 | .Cm HostbasedAuthentication | 296 | .Cm HostbasedAuthentication |
298 | and using a | 297 | and using a |
@@ -42,7 +42,7 @@ | |||
42 | */ | 42 | */ |
43 | 43 | ||
44 | #include "includes.h" | 44 | #include "includes.h" |
45 | RCSID("$OpenBSD: sshd.c,v 1.274 2003/07/22 13:35:22 markus Exp $"); | 45 | RCSID("$OpenBSD: sshd.c,v 1.275 2003/08/13 08:46:31 markus Exp $"); |
46 | 46 | ||
47 | #include <openssl/dh.h> | 47 | #include <openssl/dh.h> |
48 | #include <openssl/bn.h> | 48 | #include <openssl/bn.h> |
@@ -1462,20 +1462,7 @@ main(int ac, char **av) | |||
1462 | alarm(options.login_grace_time); | 1462 | alarm(options.login_grace_time); |
1463 | 1463 | ||
1464 | sshd_exchange_identification(sock_in, sock_out); | 1464 | sshd_exchange_identification(sock_in, sock_out); |
1465 | /* | 1465 | |
1466 | * Check that the connection comes from a privileged port. | ||
1467 | * Rhosts-Authentication only makes sense from privileged | ||
1468 | * programs. Of course, if the intruder has root access on his local | ||
1469 | * machine, he can connect from any port. So do not use these | ||
1470 | * authentication methods from machines that you do not trust. | ||
1471 | */ | ||
1472 | if (options.rhosts_authentication && | ||
1473 | (remote_port >= IPPORT_RESERVED || | ||
1474 | remote_port < IPPORT_RESERVED / 2)) { | ||
1475 | debug("Rhosts Authentication disabled, " | ||
1476 | "originating port %d not trusted.", remote_port); | ||
1477 | options.rhosts_authentication = 0; | ||
1478 | } | ||
1479 | #ifdef KRB5 | 1466 | #ifdef KRB5 |
1480 | if (!packet_connection_is_ipv4() && | 1467 | if (!packet_connection_is_ipv4() && |
1481 | options.kerberos_authentication) { | 1468 | options.kerberos_authentication) { |
@@ -1643,8 +1630,6 @@ do_ssh1_kex(void) | |||
1643 | 1630 | ||
1644 | /* Declare supported authentication types. */ | 1631 | /* Declare supported authentication types. */ |
1645 | auth_mask = 0; | 1632 | auth_mask = 0; |
1646 | if (options.rhosts_authentication) | ||
1647 | auth_mask |= 1 << SSH_AUTH_RHOSTS; | ||
1648 | if (options.rhosts_rsa_authentication) | 1633 | if (options.rhosts_rsa_authentication) |
1649 | auth_mask |= 1 << SSH_AUTH_RHOSTS_RSA; | 1634 | auth_mask |= 1 << SSH_AUTH_RHOSTS_RSA; |
1650 | if (options.rsa_authentication) | 1635 | if (options.rsa_authentication) |
diff --git a/sshd_config b/sshd_config index 262b6883a..a2bd2ff60 100644 --- a/sshd_config +++ b/sshd_config | |||
@@ -1,4 +1,4 @@ | |||
1 | # $OpenBSD: sshd_config,v 1.62 2003/07/23 07:42:43 markus Exp $ | 1 | # $OpenBSD: sshd_config,v 1.63 2003/08/13 08:46:31 markus Exp $ |
2 | 2 | ||
3 | # This is the sshd server system-wide configuration file. See | 3 | # This is the sshd server system-wide configuration file. See |
4 | # sshd_config(5) for more information. | 4 | # sshd_config(5) for more information. |
@@ -40,10 +40,6 @@ | |||
40 | #PubkeyAuthentication yes | 40 | #PubkeyAuthentication yes |
41 | #AuthorizedKeysFile .ssh/authorized_keys | 41 | #AuthorizedKeysFile .ssh/authorized_keys |
42 | 42 | ||
43 | # rhosts authentication should not be used | ||
44 | #RhostsAuthentication no | ||
45 | # Don't read the user's ~/.rhosts and ~/.shosts files | ||
46 | #IgnoreRhosts yes | ||
47 | # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts | 43 | # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts |
48 | #RhostsRSAAuthentication no | 44 | #RhostsRSAAuthentication no |
49 | # similar for protocol version 2 | 45 | # similar for protocol version 2 |
@@ -51,6 +47,8 @@ | |||
51 | # Change to yes if you don't trust ~/.ssh/known_hosts for | 47 | # Change to yes if you don't trust ~/.ssh/known_hosts for |
52 | # RhostsRSAAuthentication and HostbasedAuthentication | 48 | # RhostsRSAAuthentication and HostbasedAuthentication |
53 | #IgnoreUserKnownHosts no | 49 | #IgnoreUserKnownHosts no |
50 | # Don't read the user's ~/.rhosts and ~/.shosts files | ||
51 | #IgnoreRhosts yes | ||
54 | 52 | ||
55 | # To disable tunneled clear text passwords, change to no here! | 53 | # To disable tunneled clear text passwords, change to no here! |
56 | #PasswordAuthentication yes | 54 | #PasswordAuthentication yes |
diff --git a/sshd_config.5 b/sshd_config.5 index 223ff8aae..3d920cc80 100644 --- a/sshd_config.5 +++ b/sshd_config.5 | |||
@@ -34,7 +34,7 @@ | |||
34 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | 34 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
35 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | 35 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
36 | .\" | 36 | .\" |
37 | .\" $OpenBSD: sshd_config.5,v 1.21 2003/07/22 13:35:22 markus Exp $ | 37 | .\" $OpenBSD: sshd_config.5,v 1.22 2003/08/13 08:46:31 markus Exp $ |
38 | .Dd September 25, 1999 | 38 | .Dd September 25, 1999 |
39 | .Dt SSHD_CONFIG 5 | 39 | .Dt SSHD_CONFIG 5 |
40 | .Os | 40 | .Os |
@@ -260,7 +260,6 @@ Specifies that | |||
260 | and | 260 | and |
261 | .Pa .shosts | 261 | .Pa .shosts |
262 | files will not be used in | 262 | files will not be used in |
263 | .Cm RhostsAuthentication , | ||
264 | .Cm RhostsRSAAuthentication | 263 | .Cm RhostsRSAAuthentication |
265 | or | 264 | or |
266 | .Cm HostbasedAuthentication . | 265 | .Cm HostbasedAuthentication . |
@@ -529,10 +528,6 @@ Specifies whether public key authentication is allowed. | |||
529 | The default is | 528 | The default is |
530 | .Dq yes . | 529 | .Dq yes . |
531 | Note that this option applies to protocol version 2 only. | 530 | Note that this option applies to protocol version 2 only. |
532 | .It Cm RhostsAuthentication | ||
533 | Specifies whether authentication using rhosts or /etc/hosts.equiv | ||
534 | files is sufficient. | ||
535 | Normally, this method should not be permitted because it is insecure. | ||
536 | .Cm RhostsRSAAuthentication | 531 | .Cm RhostsRSAAuthentication |
537 | should be used | 532 | should be used |
538 | instead, because it performs RSA-based host authentication in addition | 533 | instead, because it performs RSA-based host authentication in addition |