* New upstream release (http://www.openssh.org/txt/release-5.9).

  - Introduce sandboxing of the pre-auth privsep child using an optional
    sshd_config(5) "UsePrivilegeSeparation=sandbox" mode that enables
    mandatory restrictions on the syscalls the privsep child can perform.
  - Add new SHA256-based HMAC transport integrity modes from
    http://www.ietf.org/id/draft-dbider-sha2-mac-for-ssh-02.txt.
  - The pre-authentication sshd(8) privilege separation slave process now
    logs via a socket shared with the master process, avoiding the need to
    maintain /dev/log inside the chroot (closes: #75043, #429243,
    #599240).
  - ssh(1) now warns when a server refuses X11 forwarding (closes:
    #504757).
  - sshd_config(5)'s AuthorizedKeysFile now accepts multiple paths,
    separated by whitespace (closes: #76312).  The authorized_keys2
    fallback is deprecated but documented (closes: #560156).
  - ssh(1) and sshd(8): set IPv6 traffic class from IPQoS, as well as IPv4
    ToS/DSCP (closes: #498297).
  - ssh-add(1) now accepts keys piped from standard input.  E.g. "ssh-add
    - < /path/to/key" (closes: #229124).
  - Clean up lost-passphrase text in ssh-keygen(1) (closes: #444691).
  - Say "required" rather than "recommended" in unprotected-private-key
    warning (LP: #663455).

1 files changed, 39 insertions, 31 deletions

diff --git a/auth-rsa.c b/auth-rsa.c
index ec32c803f..99c4e882d 100644
--- a/auth-rsa.c
+++ b/auth-rsa.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth-rsa.c,v 1.79 2010/12/03 23:55:27 djm Exp $ */
+/* $OpenBSD: auth-rsa.c,v 1.80 2011/05/23 03:30:07 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -160,38 +160,20 @@ auth_rsa_challenge_dialog(Key *key)
         return (success);
 }
 
-/*
- * check if there's user key matching client_n,
- * return key if login is allowed, NULL otherwise
- */
-
-int
-auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey)
+static int
+rsa_key_allowed_in_file(struct passwd *pw, char *file,
+    const BIGNUM *client_n, Key **rkey)
 {
-        char line[SSH_MAX_PUBKEY_BYTES], *file;
+        char line[SSH_MAX_PUBKEY_BYTES];
         int allowed = 0;
         u_int bits;
         FILE *f;
         u_long linenum = 0;
         Key *key;
 
-        /* Temporarily use the user's uid. */
-        temporarily_use_uid(pw);
-
-        /* The authorized keys. */
-        file = authorized_keys_file(pw);
         debug("trying public RSA key file %s", file);
-        f = auth_openkeyfile(file, pw, options.strict_modes);
-        if (!f) {
-                xfree(file);
-                restore_uid();
-                return (0);
-        }
-
-        /* Flag indicating whether the key is allowed. */
-        allowed = 0;
-
-        key = key_new(KEY_RSA1);
+        if ((f = auth_openkeyfile(file, pw, options.strict_modes)) == NULL)
+                return 0;
 
         auth_start_parse_options();
 
@@ -200,6 +182,7 @@ auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey)
          * found, perform a challenge-response dialog to verify that the
          * user really has the corresponding private key.
          */
+        key = key_new(KEY_RSA1);
         while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) {
                 char *cp;
                 char *key_options;
@@ -237,7 +220,10 @@ auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey)
                 }
                 /* cp now points to the comment part. */
 
-                /* Check if the we have found the desired key (identified by its modulus). */
+                /*
+                 * Check if the we have found the desired key (identified
+                 * by its modulus).
+                 */
                 if (BN_cmp(key->rsa->n, client_n) != 0)
                         continue;
 
@@ -266,11 +252,7 @@ auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey)
                 break;
         }
 
-        /* Restore the privileged uid. */
-        restore_uid();
-
         /* Close the file. */
-        xfree(file);
         fclose(f);
 
         /* return key if allowed */
@@ -278,7 +260,33 @@ auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey)
                 *rkey = key;
         else
                 key_free(key);
-        return (allowed);
+
+        return allowed;
+}
+
+/*
+ * check if there's user key matching client_n,
+ * return key if login is allowed, NULL otherwise
+ */
+
+int
+auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey)
+{
+        char *file;
+        u_int i, allowed = 0;
+
+        temporarily_use_uid(pw);
+
+        for (i = 0; !allowed && i < options.num_authkeys_files; i++) {
+                file = expand_authorized_keys(
+                    options.authorized_keys_files[i], pw);
+                allowed = rsa_key_allowed_in_file(pw, file, client_n, rkey);
+                xfree(file);
+        }
+
+        restore_uid();
+
+        return allowed;
 }
 
 /*