- (bal) OpenBSD CVS Update

   - markus@cvs.openbsd.org 2000/12/28 14:25:51
     [auth.h auth2.c]
     count authentication failures only
   - markus@cvs.openbsd.org 2000/12/28 14:25:03
     [sshconnect.c]
     fingerprint for MITM attacks, too.
   - markus@cvs.openbsd.org 2000/12/28 12:03:57
     [sshd.8 sshd.c]
     document -D
   - markus@cvs.openbsd.org 2000/12/27 14:19:21
     [serverloop.c]
     less chatty
   - markus@cvs.openbsd.org 2000/12/27 12:34
     [auth1.c sshconnect2.c sshd.c]
     typo
   - markus@cvs.openbsd.org 2000/12/27 12:30:19
     [readconf.c readconf.h ssh.1 sshconnect.c]
     new option: HostKeyAlias: allow the user to record the host key
     under a different name. This is useful for ssh tunneling over
     forwarded connections or if you run multiple sshd's on different
     ports on the same machine.
   - markus@cvs.openbsd.org 2000/12/27 11:51:53
     [ssh.1 ssh.c]
     multiple -t force pty allocation, document ORIGINAL_COMMAND
   - markus@cvs.openbsd.org 2000/12/27 11:41:31
     [sshd.8]
     update for ssh-2

1 files changed, 23 insertions, 7 deletions

diff --git a/sshconnect.c b/sshconnect.c
index 647aec797..22e691424 100644
--- a/sshconnect.c
+++ b/sshconnect.c
@@ -13,7 +13,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: sshconnect.c,v 1.85 2000/12/21 15:10:17 markus Exp $");
+RCSID("$OpenBSD: sshconnect.c,v 1.87 2000/12/28 14:25:03 markus Exp $");
 
 #include <openssl/bn.h>
 #include <openssl/dsa.h>
@@ -499,8 +499,13 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
                 break;
         }
         if (local) {
-                debug("Forcing accepting of host key for loopback/localhost.");
-                return;
+                if (options.host_key_alias == NULL) {
+                        debug("Forcing accepting of host key for "
+                            "loopback/localhost.");
+                        return;
+                }
+                if (options.check_host_ip)
+                        options.check_host_ip = 0;
         }
 
         /*
@@ -514,7 +519,7 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
 
         if (options.proxy_command == NULL) {
                 if (getnameinfo(hostaddr, salen, ntop, sizeof(ntop),
-                                NULL, 0, NI_NUMERICHOST) != 0)
+                    NULL, 0, NI_NUMERICHOST) != 0)
                         fatal("check_host_key: getnameinfo failed");
                 ip = xstrdup(ntop);
         } else {
@@ -522,6 +527,16 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
         }
 
         /*
+         * Allow the user to record the key under a different name. This is
+         * useful for ssh tunneling over forwarded connections or if you run
+         * multiple sshd's on different ports on the same machine.
+         */
+        if (options.host_key_alias != NULL) {
+                host = options.host_key_alias;
+                debug("using hostkeyalias: %s", host);
+        }
+
+        /*
          * Store the host key from the known host file in here so that we can
          * compare it with the key for the IP address.
          */
@@ -592,12 +607,11 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
                 } else if (options.strict_host_key_checking == 2) {
                         /* The default */
                         char prompt[1024];
-                        char *fp = key_fingerprint(host_key);
                         snprintf(prompt, sizeof(prompt),
                             "The authenticity of host '%.200s (%s)' can't be established.\n"
                             "%s key fingerprint is %s.\n"
                             "Are you sure you want to continue connecting (yes/no)? ",
-                            host, ip, type, fp);
+                            host, ip, type, key_fingerprint(host_key));
                         if (!read_yes_or_no(prompt, -1))
                                 fatal("Aborted by user!\n");
                 }
@@ -642,9 +656,11 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
                 error("IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!");
                 error("Someone could be eavesdropping on you right now (man-in-the-middle attack)!");
                 error("It is also possible that the %s host key has just been changed.", type);
+                error("The fingerprint for the %s key sent by the remote host is\n%s.",
+                    type, key_fingerprint(host_key));
                 error("Please contact your system administrator.");
                 error("Add correct host key in %.100s to get rid of this message.",
-                      user_hostfile);
+                    user_hostfile);
                 error("Offending key in %s:%d", host_file, host_line);
 
                 /*