upstream commit

add sshd_config HostbasedAcceptedKeyTypes and
 PubkeyAcceptedKeyTypes options to allow sshd to control what public key types
 will be accepted. Currently defaults to all. Feedback & ok markus@

1 files changed, 8 insertions, 1 deletions

diff --git a/auth2-pubkey.c b/auth2-pubkey.c
index 2b0486222..d922eea26 100644
--- a/auth2-pubkey.c
+++ b/auth2-pubkey.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-pubkey.c,v 1.44 2014/12/22 07:51:30 djm Exp $ */
+/* $OpenBSD: auth2-pubkey.c,v 1.45 2015/01/13 07:39:19 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -127,6 +127,13 @@ userauth_pubkey(Authctxt *authctxt)
                 logit("refusing previously-used %s key", key_type(key));
                 goto done;
         }
+        if (match_pattern_list(sshkey_ssh_name(key), options.pubkey_key_types,
+            strlen(options.pubkey_key_types), 0) != 1) {
+                logit("%s: key type %s not in PubkeyAcceptedKeyTypes",
+                    __func__, sshkey_ssh_name(key));
+                goto done;
+        }
+
         if (have_sig) {
                 sig = packet_get_string(&slen);
                 packet_check_eom();