summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKees Cook <kees@debian.org>2014-02-09 16:10:06 +0000
committerColin Watson <cjwatson@debian.org>2016-01-04 15:07:01 +0000
commite35768a64e1ca5a6ad2a5df3ebbe6806ffb8afa2 (patch)
treee86aae06998b1740f4d67b7f054dfea2f59a84e6
parent3b79d6bcaf9405b878496c9107855ebe8906a60a (diff)
Add DebianBanner server configuration option
Setting this to "no" causes sshd to omit the Debian revision from its initial protocol handshake, for those scared by package-versioning.patch. Bug-Debian: http://bugs.debian.org/562048 Forwarded: not-needed Last-Update: 2015-11-29 Patch-Name: debian-banner.patch
-rw-r--r--servconf.c9
-rw-r--r--servconf.h2
-rw-r--r--sshd.c3
-rw-r--r--sshd_config.55
4 files changed, 18 insertions, 1 deletions
diff --git a/servconf.c b/servconf.c
index ed3a88d4b..a778f44e9 100644
--- a/servconf.c
+++ b/servconf.c
@@ -171,6 +171,7 @@ initialize_server_options(ServerOptions *options)
171 options->ip_qos_bulk = -1; 171 options->ip_qos_bulk = -1;
172 options->version_addendum = NULL; 172 options->version_addendum = NULL;
173 options->fingerprint_hash = -1; 173 options->fingerprint_hash = -1;
174 options->debian_banner = -1;
174} 175}
175 176
176/* Returns 1 if a string option is unset or set to "none" or 0 otherwise. */ 177/* Returns 1 if a string option is unset or set to "none" or 0 otherwise. */
@@ -347,6 +348,8 @@ fill_default_server_options(ServerOptions *options)
347 options->fwd_opts.streamlocal_bind_unlink = 0; 348 options->fwd_opts.streamlocal_bind_unlink = 0;
348 if (options->fingerprint_hash == -1) 349 if (options->fingerprint_hash == -1)
349 options->fingerprint_hash = SSH_FP_HASH_DEFAULT; 350 options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
351 if (options->debian_banner == -1)
352 options->debian_banner = 1;
350 353
351 if (kex_assemble_names(KEX_SERVER_ENCRYPT, &options->ciphers) != 0 || 354 if (kex_assemble_names(KEX_SERVER_ENCRYPT, &options->ciphers) != 0 ||
352 kex_assemble_names(KEX_SERVER_MAC, &options->macs) != 0 || 355 kex_assemble_names(KEX_SERVER_MAC, &options->macs) != 0 ||
@@ -430,6 +433,7 @@ typedef enum {
430 sAuthenticationMethods, sHostKeyAgent, sPermitUserRC, 433 sAuthenticationMethods, sHostKeyAgent, sPermitUserRC,
431 sStreamLocalBindMask, sStreamLocalBindUnlink, 434 sStreamLocalBindMask, sStreamLocalBindUnlink,
432 sAllowStreamLocalForwarding, sFingerprintHash, 435 sAllowStreamLocalForwarding, sFingerprintHash,
436 sDebianBanner,
433 sDeprecated, sUnsupported 437 sDeprecated, sUnsupported
434} ServerOpCodes; 438} ServerOpCodes;
435 439
@@ -577,6 +581,7 @@ static struct {
577 { "streamlocalbindunlink", sStreamLocalBindUnlink, SSHCFG_ALL }, 581 { "streamlocalbindunlink", sStreamLocalBindUnlink, SSHCFG_ALL },
578 { "allowstreamlocalforwarding", sAllowStreamLocalForwarding, SSHCFG_ALL }, 582 { "allowstreamlocalforwarding", sAllowStreamLocalForwarding, SSHCFG_ALL },
579 { "fingerprinthash", sFingerprintHash, SSHCFG_GLOBAL }, 583 { "fingerprinthash", sFingerprintHash, SSHCFG_GLOBAL },
584 { "debianbanner", sDebianBanner, SSHCFG_GLOBAL },
580 { NULL, sBadOption, 0 } 585 { NULL, sBadOption, 0 }
581}; 586};
582 587
@@ -1867,6 +1872,10 @@ process_server_config_line(ServerOptions *options, char *line,
1867 options->fingerprint_hash = value; 1872 options->fingerprint_hash = value;
1868 break; 1873 break;
1869 1874
1875 case sDebianBanner:
1876 intptr = &options->debian_banner;
1877 goto parse_int;
1878
1870 case sDeprecated: 1879 case sDeprecated:
1871 logit("%s line %d: Deprecated option %s", 1880 logit("%s line %d: Deprecated option %s",
1872 filename, linenum, arg); 1881 filename, linenum, arg);
diff --git a/servconf.h b/servconf.h
index 778ba1742..161fa37c4 100644
--- a/servconf.h
+++ b/servconf.h
@@ -197,6 +197,8 @@ typedef struct {
197 char *auth_methods[MAX_AUTH_METHODS]; 197 char *auth_methods[MAX_AUTH_METHODS];
198 198
199 int fingerprint_hash; 199 int fingerprint_hash;
200
201 int debian_banner;
200} ServerOptions; 202} ServerOptions;
201 203
202/* Information about the incoming connection as used by Match */ 204/* Information about the incoming connection as used by Match */
diff --git a/sshd.c b/sshd.c
index 0d4fb7f33..6024e0e73 100644
--- a/sshd.c
+++ b/sshd.c
@@ -443,7 +443,8 @@ sshd_exchange_identification(int sock_in, int sock_out)
443 } 443 }
444 444
445 xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s%s", 445 xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s%s",
446 major, minor, SSH_RELEASE, 446 major, minor,
447 options.debian_banner ? SSH_RELEASE : SSH_RELEASE_MINIMUM,
447 *options.version_addendum == '\0' ? "" : " ", 448 *options.version_addendum == '\0' ? "" : " ",
448 options.version_addendum, newline); 449 options.version_addendum, newline);
449 450
diff --git a/sshd_config.5 b/sshd_config.5
index c8ee35dfc..b149bd3f7 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -533,6 +533,11 @@ or
533.Dq no . 533.Dq no .
534The default is 534The default is
535.Dq delayed . 535.Dq delayed .
536.It Cm DebianBanner
537Specifies whether the distribution-specified extra version suffix is
538included during initial protocol handshake.
539The default is
540.Dq yes .
536.It Cm DenyGroups 541.It Cm DenyGroups
537This keyword can be followed by a list of group name patterns, separated 542This keyword can be followed by a list of group name patterns, separated
538by spaces. 543by spaces.