diff options
author | Kees Cook <kees@debian.org> | 2014-02-09 16:10:06 +0000 |
---|---|---|
committer | Colin Watson <cjwatson@debian.org> | 2018-04-03 18:40:41 +0100 |
commit | 9ec4db016a0510c449f9cefeb3299c2e755698c7 (patch) | |
tree | 8882d14c8d4e07a9dd7d0cd1d16698ccfc227260 | |
parent | 52359fc0d6ee73ee6e24332b2777dc8abdaed652 (diff) |
Add DebianBanner server configuration option
Setting this to "no" causes sshd to omit the Debian revision from its
initial protocol handshake, for those scared by package-versioning.patch.
Bug-Debian: http://bugs.debian.org/562048
Forwarded: not-needed
Last-Update: 2018-04-03
Patch-Name: debian-banner.patch
-rw-r--r-- | servconf.c | 9 | ||||
-rw-r--r-- | servconf.h | 2 | ||||
-rw-r--r-- | sshd.c | 3 | ||||
-rw-r--r-- | sshd_config.5 | 5 |
4 files changed, 18 insertions, 1 deletions
diff --git a/servconf.c b/servconf.c index 3fff3d531..0a8f6fd62 100644 --- a/servconf.c +++ b/servconf.c | |||
@@ -177,6 +177,7 @@ initialize_server_options(ServerOptions *options) | |||
177 | options->fingerprint_hash = -1; | 177 | options->fingerprint_hash = -1; |
178 | options->disable_forwarding = -1; | 178 | options->disable_forwarding = -1; |
179 | options->expose_userauth_info = -1; | 179 | options->expose_userauth_info = -1; |
180 | options->debian_banner = -1; | ||
180 | } | 181 | } |
181 | 182 | ||
182 | /* Returns 1 if a string option is unset or set to "none" or 0 otherwise. */ | 183 | /* Returns 1 if a string option is unset or set to "none" or 0 otherwise. */ |
@@ -393,6 +394,8 @@ fill_default_server_options(ServerOptions *options) | |||
393 | options->disable_forwarding = 0; | 394 | options->disable_forwarding = 0; |
394 | if (options->expose_userauth_info == -1) | 395 | if (options->expose_userauth_info == -1) |
395 | options->expose_userauth_info = 0; | 396 | options->expose_userauth_info = 0; |
397 | if (options->debian_banner == -1) | ||
398 | options->debian_banner = 1; | ||
396 | 399 | ||
397 | assemble_algorithms(options); | 400 | assemble_algorithms(options); |
398 | 401 | ||
@@ -480,6 +483,7 @@ typedef enum { | |||
480 | sStreamLocalBindMask, sStreamLocalBindUnlink, | 483 | sStreamLocalBindMask, sStreamLocalBindUnlink, |
481 | sAllowStreamLocalForwarding, sFingerprintHash, sDisableForwarding, | 484 | sAllowStreamLocalForwarding, sFingerprintHash, sDisableForwarding, |
482 | sExposeAuthInfo, sRDomain, | 485 | sExposeAuthInfo, sRDomain, |
486 | sDebianBanner, | ||
483 | sDeprecated, sIgnore, sUnsupported | 487 | sDeprecated, sIgnore, sUnsupported |
484 | } ServerOpCodes; | 488 | } ServerOpCodes; |
485 | 489 | ||
@@ -634,6 +638,7 @@ static struct { | |||
634 | { "disableforwarding", sDisableForwarding, SSHCFG_ALL }, | 638 | { "disableforwarding", sDisableForwarding, SSHCFG_ALL }, |
635 | { "exposeauthinfo", sExposeAuthInfo, SSHCFG_ALL }, | 639 | { "exposeauthinfo", sExposeAuthInfo, SSHCFG_ALL }, |
636 | { "rdomain", sRDomain, SSHCFG_ALL }, | 640 | { "rdomain", sRDomain, SSHCFG_ALL }, |
641 | { "debianbanner", sDebianBanner, SSHCFG_GLOBAL }, | ||
637 | { NULL, sBadOption, 0 } | 642 | { NULL, sBadOption, 0 } |
638 | }; | 643 | }; |
639 | 644 | ||
@@ -2056,6 +2061,10 @@ process_server_config_line(ServerOptions *options, char *line, | |||
2056 | *charptr = xstrdup(arg); | 2061 | *charptr = xstrdup(arg); |
2057 | break; | 2062 | break; |
2058 | 2063 | ||
2064 | case sDebianBanner: | ||
2065 | intptr = &options->debian_banner; | ||
2066 | goto parse_flag; | ||
2067 | |||
2059 | case sDeprecated: | 2068 | case sDeprecated: |
2060 | case sIgnore: | 2069 | case sIgnore: |
2061 | case sUnsupported: | 2070 | case sUnsupported: |
diff --git a/servconf.h b/servconf.h index 5dfc9bc02..b0fa70455 100644 --- a/servconf.h +++ b/servconf.h | |||
@@ -211,6 +211,8 @@ typedef struct { | |||
211 | 211 | ||
212 | int fingerprint_hash; | 212 | int fingerprint_hash; |
213 | int expose_userauth_info; | 213 | int expose_userauth_info; |
214 | |||
215 | int debian_banner; | ||
214 | } ServerOptions; | 216 | } ServerOptions; |
215 | 217 | ||
216 | /* Information about the incoming connection as used by Match */ | 218 | /* Information about the incoming connection as used by Match */ |
@@ -384,7 +384,8 @@ sshd_exchange_identification(struct ssh *ssh, int sock_in, int sock_out) | |||
384 | char remote_version[256]; /* Must be at least as big as buf. */ | 384 | char remote_version[256]; /* Must be at least as big as buf. */ |
385 | 385 | ||
386 | xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s\r\n", | 386 | xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s\r\n", |
387 | PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE, | 387 | PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, |
388 | options.debian_banner ? SSH_RELEASE : SSH_RELEASE_MINIMUM, | ||
388 | *options.version_addendum == '\0' ? "" : " ", | 389 | *options.version_addendum == '\0' ? "" : " ", |
389 | options.version_addendum); | 390 | options.version_addendum); |
390 | 391 | ||
diff --git a/sshd_config.5 b/sshd_config.5 index 1a1c6dd09..45044a70f 100644 --- a/sshd_config.5 +++ b/sshd_config.5 | |||
@@ -531,6 +531,11 @@ or | |||
531 | .Cm no . | 531 | .Cm no . |
532 | The default is | 532 | The default is |
533 | .Cm yes . | 533 | .Cm yes . |
534 | .It Cm DebianBanner | ||
535 | Specifies whether the distribution-specified extra version suffix is | ||
536 | included during initial protocol handshake. | ||
537 | The default is | ||
538 | .Cm yes . | ||
534 | .It Cm DenyGroups | 539 | .It Cm DenyGroups |
535 | This keyword can be followed by a list of group name patterns, separated | 540 | This keyword can be followed by a list of group name patterns, separated |
536 | by spaces. | 541 | by spaces. |