- Move C/R -> kbdint special case to after the defaults have been

    loaded, which makes ChallengeResponse default to yes again. This was
    broken by the Match changes and not fixed properly subsequently
    (closes: #428968).

3 files changed, 8 insertions, 4 deletions

diff --git a/debian/changelog b/debian/changelog
index 7ffc040da..0a310cdaa 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -13,6 +13,10 @@ openssh (1:4.6p1-2) UNRELEASED; urgency=low
   * Add /etc/network/if-up.d/openssh-server to restart sshd when new
     interfaces appear (LP: #103436).
   * Backport from upstream:
+    - Move C/R -> kbdint special case to after the defaults have been
+      loaded, which makes ChallengeResponse default to yes again. This was
+      broken by the Match changes and not fixed properly subsequently
+      (closes: #428968).
     - Silence spurious error messages from hang-on-exit fix
       (http://bugzilla.mindrot.org/show_bug.cgi?id=1306, closes: #429531).
 
diff --git a/servconf.c b/servconf.c
index 951bbc4bf..04b1a597e 100644
--- a/servconf.c
+++ b/servconf.c
@@ -1411,8 +1411,4 @@ parse_server_config(ServerOptions *options, const char *filename, Buffer *conf,
         if (bad_options > 0)
                 fatal("%s: terminating, %d bad configuration options",
                     filename, bad_options);
-
-        /* challenge-response is implemented via keyboard interactive */
-        if (options->challenge_response_authentication == 1)
-                options->kbd_interactive_authentication = 1;
 }
diff --git a/sshd.c b/sshd.c
index dd873ef72..985f05917 100644
--- a/sshd.c
+++ b/sshd.c
@@ -1430,6 +1430,10 @@ main(int ac, char **av)
         /* Fill in default values for those options not explicitly set. */
         fill_default_server_options(&options);
 
+        /* challenge-response is implemented via keyboard interactive */
+        if (options.challenge_response_authentication)
+                options.kbd_interactive_authentication = 1;
+
         /* set default channel AF */
         channel_set_af(options.address_family);