summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKees Cook <kees@debian.org>2014-02-09 16:10:06 +0000
committerColin Watson <cjwatson@debian.org>2016-02-29 12:34:03 +0000
commit3c79e49a4fbd8e4c84f6af6f1173563bda8b273b (patch)
treecdaa60672213a3389915628ea13a5cc827822214
parentf7587633dc374db82455fe7a3fa921de5c4a897b (diff)
Add DebianBanner server configuration option
Setting this to "no" causes sshd to omit the Debian revision from its initial protocol handshake, for those scared by package-versioning.patch. Bug-Debian: http://bugs.debian.org/562048 Forwarded: not-needed Last-Update: 2015-11-29 Patch-Name: debian-banner.patch
-rw-r--r--servconf.c9
-rw-r--r--servconf.h2
-rw-r--r--sshd.c3
-rw-r--r--sshd_config.55
4 files changed, 18 insertions, 1 deletions
diff --git a/servconf.c b/servconf.c
index fad7c92ef..8ca9695a2 100644
--- a/servconf.c
+++ b/servconf.c
@@ -171,6 +171,7 @@ initialize_server_options(ServerOptions *options)
171 options->ip_qos_bulk = -1; 171 options->ip_qos_bulk = -1;
172 options->version_addendum = NULL; 172 options->version_addendum = NULL;
173 options->fingerprint_hash = -1; 173 options->fingerprint_hash = -1;
174 options->debian_banner = -1;
174} 175}
175 176
176/* Returns 1 if a string option is unset or set to "none" or 0 otherwise. */ 177/* Returns 1 if a string option is unset or set to "none" or 0 otherwise. */
@@ -359,6 +360,8 @@ fill_default_server_options(ServerOptions *options)
359 options->fwd_opts.streamlocal_bind_unlink = 0; 360 options->fwd_opts.streamlocal_bind_unlink = 0;
360 if (options->fingerprint_hash == -1) 361 if (options->fingerprint_hash == -1)
361 options->fingerprint_hash = SSH_FP_HASH_DEFAULT; 362 options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
363 if (options->debian_banner == -1)
364 options->debian_banner = 1;
362 365
363 assemble_algorithms(options); 366 assemble_algorithms(options);
364 367
@@ -437,6 +440,7 @@ typedef enum {
437 sAuthenticationMethods, sHostKeyAgent, sPermitUserRC, 440 sAuthenticationMethods, sHostKeyAgent, sPermitUserRC,
438 sStreamLocalBindMask, sStreamLocalBindUnlink, 441 sStreamLocalBindMask, sStreamLocalBindUnlink,
439 sAllowStreamLocalForwarding, sFingerprintHash, 442 sAllowStreamLocalForwarding, sFingerprintHash,
443 sDebianBanner,
440 sDeprecated, sUnsupported 444 sDeprecated, sUnsupported
441} ServerOpCodes; 445} ServerOpCodes;
442 446
@@ -588,6 +592,7 @@ static struct {
588 { "streamlocalbindunlink", sStreamLocalBindUnlink, SSHCFG_ALL }, 592 { "streamlocalbindunlink", sStreamLocalBindUnlink, SSHCFG_ALL },
589 { "allowstreamlocalforwarding", sAllowStreamLocalForwarding, SSHCFG_ALL }, 593 { "allowstreamlocalforwarding", sAllowStreamLocalForwarding, SSHCFG_ALL },
590 { "fingerprinthash", sFingerprintHash, SSHCFG_GLOBAL }, 594 { "fingerprinthash", sFingerprintHash, SSHCFG_GLOBAL },
595 { "debianbanner", sDebianBanner, SSHCFG_GLOBAL },
591 { NULL, sBadOption, 0 } 596 { NULL, sBadOption, 0 }
592}; 597};
593 598
@@ -1874,6 +1879,10 @@ process_server_config_line(ServerOptions *options, char *line,
1874 options->fingerprint_hash = value; 1879 options->fingerprint_hash = value;
1875 break; 1880 break;
1876 1881
1882 case sDebianBanner:
1883 intptr = &options->debian_banner;
1884 goto parse_int;
1885
1877 case sDeprecated: 1886 case sDeprecated:
1878 logit("%s line %d: Deprecated option %s", 1887 logit("%s line %d: Deprecated option %s",
1879 filename, linenum, arg); 1888 filename, linenum, arg);
diff --git a/servconf.h b/servconf.h
index 778ba1742..161fa37c4 100644
--- a/servconf.h
+++ b/servconf.h
@@ -197,6 +197,8 @@ typedef struct {
197 char *auth_methods[MAX_AUTH_METHODS]; 197 char *auth_methods[MAX_AUTH_METHODS];
198 198
199 int fingerprint_hash; 199 int fingerprint_hash;
200
201 int debian_banner;
200} ServerOptions; 202} ServerOptions;
201 203
202/* Information about the incoming connection as used by Match */ 204/* Information about the incoming connection as used by Match */
diff --git a/sshd.c b/sshd.c
index c762190dc..57ae4add8 100644
--- a/sshd.c
+++ b/sshd.c
@@ -442,7 +442,8 @@ sshd_exchange_identification(int sock_in, int sock_out)
442 } 442 }
443 443
444 xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s%s", 444 xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s%s",
445 major, minor, SSH_RELEASE, 445 major, minor,
446 options.debian_banner ? SSH_RELEASE : SSH_RELEASE_MINIMUM,
446 *options.version_addendum == '\0' ? "" : " ", 447 *options.version_addendum == '\0' ? "" : " ",
447 options.version_addendum, newline); 448 options.version_addendum, newline);
448 449
diff --git a/sshd_config.5 b/sshd_config.5
index bc79a6636..b56564044 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -534,6 +534,11 @@ or
534.Dq no . 534.Dq no .
535The default is 535The default is
536.Dq delayed . 536.Dq delayed .
537.It Cm DebianBanner
538Specifies whether the distribution-specified extra version suffix is
539included during initial protocol handshake.
540The default is
541.Dq yes .
537.It Cm DenyGroups 542.It Cm DenyGroups
538This keyword can be followed by a list of group name patterns, separated 543This keyword can be followed by a list of group name patterns, separated
539by spaces. 544by spaces.