diff options
author | Damien Miller <djm@mindrot.org> | 2010-02-27 07:55:05 +1100 |
---|---|---|
committer | Damien Miller <djm@mindrot.org> | 2010-02-27 07:55:05 +1100 |
commit | 0a80ca190a39943029719facf7edb990def7ae62 (patch) | |
tree | e423e30d8412de67170b8240ba919df10ed8e391 /servconf.h | |
parent | d27d85d5320bb946d4bb734dcf45a8d20bad6020 (diff) |
- OpenBSD CVS Sync
- djm@cvs.openbsd.org 2010/02/26 20:29:54
[PROTOCOL PROTOCOL.agent PROTOCOL.certkeys addrmatch.c auth-options.c]
[auth-options.h auth.h auth2-pubkey.c authfd.c dns.c dns.h hostfile.c]
[hostfile.h kex.h kexdhs.c kexgexs.c key.c key.h match.h monitor.c]
[myproposal.h servconf.c servconf.h ssh-add.c ssh-agent.c ssh-dss.c]
[ssh-keygen.1 ssh-keygen.c ssh-rsa.c ssh.1 ssh.c ssh2.h sshconnect.c]
[sshconnect2.c sshd.8 sshd.c sshd_config.5]
Add support for certificate key types for users and hosts.
OpenSSH certificate key types are not X.509 certificates, but a much
simpler format that encodes a public key, identity information and
some validity constraints and signs it with a CA key. CA keys are
regular SSH keys. This certificate style avoids the attack surface
of X.509 certificates and is very easy to deploy.
Certified host keys allow automatic acceptance of new host keys
when a CA certificate is marked as sh/known_hosts.
see VERIFYING HOST KEYS in ssh(1) for details.
Certified user keys allow authentication of users when the signing
CA key is marked as trusted in authorized_keys. See "AUTHORIZED_KEYS
FILE FORMAT" in sshd(8) for details.
Certificates are minted using ssh-keygen(1), documentation is in
the "CERTIFICATES" section of that manpage.
Documentation on the format of certificates is in the file
PROTOCOL.certkeys
feedback and ok markus@
Diffstat (limited to 'servconf.h')
-rw-r--r-- | servconf.h | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/servconf.h b/servconf.h index c9b8619cd..c5c9c6ecd 100644 --- a/servconf.h +++ b/servconf.h | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: servconf.h,v 1.90 2010/01/13 03:48:13 djm Exp $ */ | 1 | /* $OpenBSD: servconf.h,v 1.91 2010/02/26 20:29:54 djm Exp $ */ |
2 | 2 | ||
3 | /* | 3 | /* |
4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
@@ -24,6 +24,7 @@ | |||
24 | #define MAX_DENY_GROUPS 256 /* Max # groups on deny list. */ | 24 | #define MAX_DENY_GROUPS 256 /* Max # groups on deny list. */ |
25 | #define MAX_SUBSYSTEMS 256 /* Max # subsystems. */ | 25 | #define MAX_SUBSYSTEMS 256 /* Max # subsystems. */ |
26 | #define MAX_HOSTKEYS 256 /* Max # hostkeys. */ | 26 | #define MAX_HOSTKEYS 256 /* Max # hostkeys. */ |
27 | #define MAX_HOSTCERTS 256 /* Max # host certificates. */ | ||
27 | #define MAX_ACCEPT_ENV 256 /* Max # of env vars. */ | 28 | #define MAX_ACCEPT_ENV 256 /* Max # of env vars. */ |
28 | #define MAX_MATCH_GROUPS 256 /* Max # of groups for Match. */ | 29 | #define MAX_MATCH_GROUPS 256 /* Max # of groups for Match. */ |
29 | 30 | ||
@@ -49,6 +50,8 @@ typedef struct { | |||
49 | int address_family; /* Address family used by the server. */ | 50 | int address_family; /* Address family used by the server. */ |
50 | char *host_key_files[MAX_HOSTKEYS]; /* Files containing host keys. */ | 51 | char *host_key_files[MAX_HOSTKEYS]; /* Files containing host keys. */ |
51 | int num_host_key_files; /* Number of files for host keys. */ | 52 | int num_host_key_files; /* Number of files for host keys. */ |
53 | char *host_cert_files[MAX_HOSTCERTS]; /* Files containing host certs. */ | ||
54 | int num_host_cert_files; /* Number of files for host certs. */ | ||
52 | char *pid_file; /* Where to put our pid */ | 55 | char *pid_file; /* Where to put our pid */ |
53 | int server_key_bits;/* Size of the server key. */ | 56 | int server_key_bits;/* Size of the server key. */ |
54 | int login_grace_time; /* Disconnect if no auth in this time | 57 | int login_grace_time; /* Disconnect if no auth in this time |