summaryrefslogtreecommitdiff
path: root/auth-rhosts.c
diff options
context:
space:
mode:
authorColin Watson <cjwatson@debian.org>2014-02-09 16:09:58 +0000
committerColin Watson <cjwatson@debian.org>2020-02-21 12:06:07 +0000
commit3309e464e5ae6c940ddd584eed4d2d403f4c168c (patch)
treecba1516165e10e7095ab30cf8100644059865217 /auth-rhosts.c
parent387c2c1954773733bae9fca21a92db62c31180bd (diff)
Allow harmless group-writability
Allow secure files (~/.ssh/config, ~/.ssh/authorized_keys, etc.) to be group-writable, provided that the group in question contains only the file's owner. Rejected upstream for IMO incorrect reasons (e.g. a misunderstanding about the contents of gr->gr_mem). Given that per-user groups and umask 002 are the default setup in Debian (for good reasons - this makes operating in setgid directories with other groups much easier), we need to permit this by default. Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1060 Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=314347 Last-Update: 2019-10-09 Patch-Name: user-group-modes.patch
Diffstat (limited to 'auth-rhosts.c')
-rw-r--r--auth-rhosts.c6
1 files changed, 2 insertions, 4 deletions
diff --git a/auth-rhosts.c b/auth-rhosts.c
index 7a10210b6..587f53721 100644
--- a/auth-rhosts.c
+++ b/auth-rhosts.c
@@ -260,8 +260,7 @@ auth_rhosts2(struct passwd *pw, const char *client_user, const char *hostname,
260 return 0; 260 return 0;
261 } 261 }
262 if (options.strict_modes && 262 if (options.strict_modes &&
263 ((st.st_uid != 0 && st.st_uid != pw->pw_uid) || 263 !secure_permissions(&st, pw->pw_uid)) {
264 (st.st_mode & 022) != 0)) {
265 logit("Rhosts authentication refused for %.100s: " 264 logit("Rhosts authentication refused for %.100s: "
266 "bad ownership or modes for home directory.", pw->pw_name); 265 "bad ownership or modes for home directory.", pw->pw_name);
267 auth_debug_add("Rhosts authentication refused for %.100s: " 266 auth_debug_add("Rhosts authentication refused for %.100s: "
@@ -287,8 +286,7 @@ auth_rhosts2(struct passwd *pw, const char *client_user, const char *hostname,
287 * allowing access to their account by anyone. 286 * allowing access to their account by anyone.
288 */ 287 */
289 if (options.strict_modes && 288 if (options.strict_modes &&
290 ((st.st_uid != 0 && st.st_uid != pw->pw_uid) || 289 !secure_permissions(&st, pw->pw_uid)) {
291 (st.st_mode & 022) != 0)) {
292 logit("Rhosts authentication refused for %.100s: bad modes for %.200s", 290 logit("Rhosts authentication refused for %.100s: bad modes for %.200s",
293 pw->pw_name, buf); 291 pw->pw_name, buf);
294 auth_debug_add("Bad file modes for %.200s", buf); 292 auth_debug_add("Bad file modes for %.200s", buf);