summaryrefslogtreecommitdiff
path: root/session.c
diff options
context:
space:
mode:
authorSimon Wilkinson <simon@sxw.org.uk>2014-02-09 16:09:48 +0000
committerColin Watson <cjwatson@debian.org>2020-10-18 12:04:32 +0100
commitd1b7918f9bce6e997c7952ac795e18d09192b2a6 (patch)
tree897785ddb933a151a3d4b7f7d1b6542aee570b76 /session.c
parent2b2c99658e3e8ed452e28f88f9cdbcdfb2a461cb (diff)
GSSAPI key exchange support
This patch has been rejected upstream: "None of the OpenSSH developers are in favour of adding this, and this situation has not changed for several years. This is not a slight on Simon's patch, which is of fine quality, but just that a) we don't trust GSSAPI implementations that much and b) we don't like adding new KEX since they are pre-auth attack surface. This one is particularly scary, since it requires hooks out to typically root-owned system resources." However, quite a lot of people rely on this in Debian, and it's better to have it merged into the main openssh package rather than having separate -krb5 packages (as we used to have). It seems to have a generally good security history. Author: Simon Wilkinson <simon@sxw.org.uk> Author: Colin Watson <cjwatson@debian.org> Author: Jakub Jelen <jjelen@redhat.com> Origin: other, https://github.com/openssh-gsskex/openssh-gsskex/commits/debian/master Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1242 Last-Updated: 2020-06-07 Patch-Name: gssapi.patch
Diffstat (limited to 'session.c')
-rw-r--r--session.c10
1 files changed, 8 insertions, 2 deletions
diff --git a/session.c b/session.c
index 27ca8a104..857f17b3c 100644
--- a/session.c
+++ b/session.c
@@ -2685,13 +2685,19 @@ do_cleanup(struct ssh *ssh, Authctxt *authctxt)
2685 2685
2686#ifdef KRB5 2686#ifdef KRB5
2687 if (options.kerberos_ticket_cleanup && 2687 if (options.kerberos_ticket_cleanup &&
2688 authctxt->krb5_ctx) 2688 authctxt->krb5_ctx) {
2689 temporarily_use_uid(authctxt->pw);
2689 krb5_cleanup_proc(authctxt); 2690 krb5_cleanup_proc(authctxt);
2691 restore_uid();
2692 }
2690#endif 2693#endif
2691 2694
2692#ifdef GSSAPI 2695#ifdef GSSAPI
2693 if (options.gss_cleanup_creds) 2696 if (options.gss_cleanup_creds) {
2697 temporarily_use_uid(authctxt->pw);
2694 ssh_gssapi_cleanup_creds(); 2698 ssh_gssapi_cleanup_creds();
2699 restore_uid();
2700 }
2695#endif 2701#endif
2696 2702
2697 /* remove agent socket */ 2703 /* remove agent socket */