diff options
author | djm@openbsd.org <djm@openbsd.org> | 2017-09-03 23:33:13 +0000 |
---|---|---|
committer | Damien Miller <djm@mindrot.org> | 2017-09-04 09:38:57 +1000 |
commit | 22376d27a349f62c502fec3396dfe0fdcb2a40b7 (patch) | |
tree | 8368234874273df676d62ffab3bfc184ef58405f /sshconnect.c | |
parent | ff3c42384033514e248ba5d7376aa033f4a2b99a (diff) |
upstream commit
Expand ssh_config's StrictModes option with two new
settings:
StrictModes=accept-new will automatically accept hitherto-unseen keys
but will refuse connections for changed or invalid hostkeys.
StrictModes=off is the same as StrictModes=no
Motivation:
StrictModes=no combines two behaviours for host key processing:
automatically learning new hostkeys and continuing to connect to hosts
with invalid/changed hostkeys. The latter behaviour is quite dangerous
since it removes most of the protections the SSH protocol is supposed to
provide.
Quite a few users want to automatically learn hostkeys however, so
this makes that feature available with less danger.
At some point in the future, StrictModes=no will change to be a synonym
for accept-new, with its current behaviour remaining available via
StrictModes=off.
bz#2400, suggested by Michael Samuel; ok markus
Upstream-ID: 0f55502bf75fc93a74fb9853264a8276b9680b64
Diffstat (limited to 'sshconnect.c')
-rw-r--r-- | sshconnect.c | 30 |
1 files changed, 18 insertions, 12 deletions
diff --git a/sshconnect.c b/sshconnect.c index 4013ec7db..2842d9e59 100644 --- a/sshconnect.c +++ b/sshconnect.c | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: sshconnect.c,v 1.284 2017/09/01 05:53:56 djm Exp $ */ | 1 | /* $OpenBSD: sshconnect.c,v 1.285 2017/09/03 23:33:13 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
@@ -891,7 +891,8 @@ check_host_key(char *hostname, struct sockaddr *hostaddr, u_short port, | |||
891 | if (readonly || want_cert) | 891 | if (readonly || want_cert) |
892 | goto fail; | 892 | goto fail; |
893 | /* The host is new. */ | 893 | /* The host is new. */ |
894 | if (options.strict_host_key_checking == 1) { | 894 | if (options.strict_host_key_checking == |
895 | SSH_STRICT_HOSTKEY_YES) { | ||
895 | /* | 896 | /* |
896 | * User has requested strict host key checking. We | 897 | * User has requested strict host key checking. We |
897 | * will not add the host key automatically. The only | 898 | * will not add the host key automatically. The only |
@@ -900,7 +901,8 @@ check_host_key(char *hostname, struct sockaddr *hostaddr, u_short port, | |||
900 | error("No %s host key is known for %.200s and you " | 901 | error("No %s host key is known for %.200s and you " |
901 | "have requested strict checking.", type, host); | 902 | "have requested strict checking.", type, host); |
902 | goto fail; | 903 | goto fail; |
903 | } else if (options.strict_host_key_checking == 2) { | 904 | } else if (options.strict_host_key_checking == |
905 | SSH_STRICT_HOSTKEY_ASK) { | ||
904 | char msg1[1024], msg2[1024]; | 906 | char msg1[1024], msg2[1024]; |
905 | 907 | ||
906 | if (show_other_keys(host_hostkeys, host_key)) | 908 | if (show_other_keys(host_hostkeys, host_key)) |
@@ -944,8 +946,8 @@ check_host_key(char *hostname, struct sockaddr *hostaddr, u_short port, | |||
944 | hostkey_trusted = 1; /* user explicitly confirmed */ | 946 | hostkey_trusted = 1; /* user explicitly confirmed */ |
945 | } | 947 | } |
946 | /* | 948 | /* |
947 | * If not in strict mode, add the key automatically to the | 949 | * If in "new" or "off" strict mode, add the key automatically |
948 | * local known_hosts file. | 950 | * to the local known_hosts file. |
949 | */ | 951 | */ |
950 | if (options.check_host_ip && ip_status == HOST_NEW) { | 952 | if (options.check_host_ip && ip_status == HOST_NEW) { |
951 | snprintf(hostline, sizeof(hostline), "%s,%s", host, ip); | 953 | snprintf(hostline, sizeof(hostline), "%s,%s", host, ip); |
@@ -987,7 +989,8 @@ check_host_key(char *hostname, struct sockaddr *hostaddr, u_short port, | |||
987 | * If strict host key checking is in use, the user will have | 989 | * If strict host key checking is in use, the user will have |
988 | * to edit the key manually and we can only abort. | 990 | * to edit the key manually and we can only abort. |
989 | */ | 991 | */ |
990 | if (options.strict_host_key_checking) { | 992 | if (options.strict_host_key_checking != |
993 | SSH_STRICT_HOSTKEY_OFF) { | ||
991 | error("%s host key for %.200s was revoked and you have " | 994 | error("%s host key for %.200s was revoked and you have " |
992 | "requested strict checking.", type, host); | 995 | "requested strict checking.", type, host); |
993 | goto fail; | 996 | goto fail; |
@@ -1040,7 +1043,8 @@ check_host_key(char *hostname, struct sockaddr *hostaddr, u_short port, | |||
1040 | * If strict host key checking is in use, the user will have | 1043 | * If strict host key checking is in use, the user will have |
1041 | * to edit the key manually and we can only abort. | 1044 | * to edit the key manually and we can only abort. |
1042 | */ | 1045 | */ |
1043 | if (options.strict_host_key_checking) { | 1046 | if (options.strict_host_key_checking != |
1047 | SSH_STRICT_HOSTKEY_OFF) { | ||
1044 | error("%s host key for %.200s has changed and you have " | 1048 | error("%s host key for %.200s has changed and you have " |
1045 | "requested strict checking.", type, host); | 1049 | "requested strict checking.", type, host); |
1046 | goto fail; | 1050 | goto fail; |
@@ -1127,15 +1131,17 @@ check_host_key(char *hostname, struct sockaddr *hostaddr, u_short port, | |||
1127 | "\nMatching host key in %s:%lu", | 1131 | "\nMatching host key in %s:%lu", |
1128 | host_found->file, host_found->line); | 1132 | host_found->file, host_found->line); |
1129 | } | 1133 | } |
1130 | if (options.strict_host_key_checking == 1) { | 1134 | if (options.strict_host_key_checking == |
1131 | logit("%s", msg); | 1135 | SSH_STRICT_HOSTKEY_ASK) { |
1132 | error("Exiting, you have requested strict checking."); | ||
1133 | goto fail; | ||
1134 | } else if (options.strict_host_key_checking == 2) { | ||
1135 | strlcat(msg, "\nAre you sure you want " | 1136 | strlcat(msg, "\nAre you sure you want " |
1136 | "to continue connecting (yes/no)? ", sizeof(msg)); | 1137 | "to continue connecting (yes/no)? ", sizeof(msg)); |
1137 | if (!confirm(msg)) | 1138 | if (!confirm(msg)) |
1138 | goto fail; | 1139 | goto fail; |
1140 | } else if (options.strict_host_key_checking != | ||
1141 | SSH_STRICT_HOSTKEY_OFF) { | ||
1142 | logit("%s", msg); | ||
1143 | error("Exiting, you have requested strict checking."); | ||
1144 | goto fail; | ||
1139 | } else { | 1145 | } else { |
1140 | logit("%s", msg); | 1146 | logit("%s", msg); |
1141 | } | 1147 | } |