diff options
author | Colin Watson <cjwatson@debian.org> | 2010-03-31 10:46:28 +0100 |
---|---|---|
committer | Colin Watson <cjwatson@debian.org> | 2010-03-31 10:46:28 +0100 |
commit | efd3d4522636ae029488c2e9730b60c88e257d2e (patch) | |
tree | 31e02ac3f16090ce8c53448677356b2b7f423683 /auth-krb5.c | |
parent | bbec4db36d464ea1d464a707625125f9fd5c7b5e (diff) | |
parent | d1a87e462e1db89f19cd960588d0c6b287cb5ccc (diff) |
* New upstream release (LP: #535029).
- After a transition period of about 10 years, this release disables SSH
protocol 1 by default. Clients and servers that need to use the
legacy protocol must explicitly enable it in ssh_config / sshd_config
or on the command-line.
- Remove the libsectok/OpenSC-based smartcard code and add support for
PKCS#11 tokens. This support is enabled by default in the Debian
packaging, since it now doesn't involve additional library
dependencies (closes: #231472, LP: #16918).
- Add support for certificate authentication of users and hosts using a
new, minimal OpenSSH certificate format (closes: #482806).
- Added a 'netcat mode' to ssh(1): "ssh -W host:port ...".
- Add the ability to revoke keys in sshd(8) and ssh(1). (For the Debian
package, this overlaps with the key blacklisting facility added in
openssh 1:4.7p1-9, but with different file formats and slightly
different scopes; for the moment, I've roughly merged the two.)
- Various multiplexing improvements, including support for requesting
port-forwardings via the multiplex protocol (closes: #360151).
- Allow setting an explicit umask on the sftp-server(8) commandline to
override whatever default the user has (closes: #496843).
- Many sftp client improvements, including tab-completion, more options,
and recursive transfer support for get/put (LP: #33378). The old
mget/mput commands never worked properly and have been removed
(closes: #270399, #428082).
- Do not prompt for a passphrase if we fail to open a keyfile, and log
the reason why the open failed to debug (closes: #431538).
- Prevent sftp from crashing when given a "-" without a command. Also,
allow whitespace to follow a "-" (closes: #531561).
Diffstat (limited to 'auth-krb5.c')
-rw-r--r-- | auth-krb5.c | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/auth-krb5.c b/auth-krb5.c index 38164fda8..821913382 100644 --- a/auth-krb5.c +++ b/auth-krb5.c | |||
@@ -78,6 +78,11 @@ auth_krb5_password(Authctxt *authctxt, const char *password) | |||
78 | krb5_error_code problem; | 78 | krb5_error_code problem; |
79 | krb5_ccache ccache = NULL; | 79 | krb5_ccache ccache = NULL; |
80 | int len; | 80 | int len; |
81 | char *client, *platform_client; | ||
82 | |||
83 | /* get platform-specific kerberos client principal name (if it exists) */ | ||
84 | platform_client = platform_krb5_get_principal_name(authctxt->pw->pw_name); | ||
85 | client = platform_client ? platform_client : authctxt->pw->pw_name; | ||
81 | 86 | ||
82 | temporarily_use_uid(authctxt->pw); | 87 | temporarily_use_uid(authctxt->pw); |
83 | 88 | ||
@@ -85,7 +90,7 @@ auth_krb5_password(Authctxt *authctxt, const char *password) | |||
85 | if (problem) | 90 | if (problem) |
86 | goto out; | 91 | goto out; |
87 | 92 | ||
88 | problem = krb5_parse_name(authctxt->krb5_ctx, authctxt->pw->pw_name, | 93 | problem = krb5_parse_name(authctxt->krb5_ctx, client, |
89 | &authctxt->krb5_user); | 94 | &authctxt->krb5_user); |
90 | if (problem) | 95 | if (problem) |
91 | goto out; | 96 | goto out; |
@@ -141,8 +146,7 @@ auth_krb5_password(Authctxt *authctxt, const char *password) | |||
141 | if (problem) | 146 | if (problem) |
142 | goto out; | 147 | goto out; |
143 | 148 | ||
144 | if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user, | 149 | if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user, client)) { |
145 | authctxt->pw->pw_name)) { | ||
146 | problem = -1; | 150 | problem = -1; |
147 | goto out; | 151 | goto out; |
148 | } | 152 | } |
@@ -181,6 +185,9 @@ auth_krb5_password(Authctxt *authctxt, const char *password) | |||
181 | 185 | ||
182 | out: | 186 | out: |
183 | restore_uid(); | 187 | restore_uid(); |
188 | |||
189 | if (platform_client != NULL) | ||
190 | xfree(platform_client); | ||
184 | 191 | ||
185 | if (problem) { | 192 | if (problem) { |
186 | if (ccache) | 193 | if (ccache) |