upstream commit

add sshd_config HostbasedAcceptedKeyTypes and
 PubkeyAcceptedKeyTypes options to allow sshd to control what public key types
 will be accepted. Currently defaults to all. Feedback & ok markus@

1 files changed, 10 insertions, 1 deletions

diff --git a/auth2-hostbased.c b/auth2-hostbased.c
index 2db3d2524..9f8a01cbe 100644
--- a/auth2-hostbased.c
+++ b/auth2-hostbased.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-hostbased.c,v 1.21 2015/01/08 10:14:08 djm Exp $ */
+/* $OpenBSD: auth2-hostbased.c,v 1.22 2015/01/13 07:39:19 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -48,6 +48,7 @@
 #endif
 #include "monitor_wrap.h"
 #include "pathnames.h"
+#include "match.h"
 
 /* import */
 extern ServerOptions options;
@@ -108,6 +109,14 @@ userauth_hostbased(Authctxt *authctxt)
                     "signature format");
                 goto done;
         }
+        if (match_pattern_list(sshkey_ssh_name(key),
+            options.hostbased_key_types,
+            strlen(options.hostbased_key_types), 0) != 1) {
+                logit("%s: key type %s not in HostbasedAcceptedKeyTypes",
+                    __func__, sshkey_type(key));
+                goto done;
+        }
+
         service = datafellows & SSH_BUG_HBSERVICE ? "ssh-userauth" :
             authctxt->service;
         buffer_init(&b);