1 files changed, 86 insertions, 61 deletions

diff --git a/servconf.c b/servconf.c
index 71e28b3cb..2510659ee 100644
--- a/servconf.c
+++ b/servconf.c
@@ -10,7 +10,23 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: servconf.c,v 1.127 2003/09/01 18:15:50 markus Exp $");
+RCSID("$OpenBSD: servconf.c,v 1.116 2003/02/21 09:05:53 markus Exp $");
+
+#if defined(KRB4)
+#include <krb.h>
+#endif
+#if defined(KRB5)
+#ifdef HEIMDAL
+#include <krb.h>
+#else
+/* Bodge - but then, so is using the kerberos IV KEYFILE to get a Kerberos V
+ * keytab */
+#define KEYFILE "/etc/krb5.keytab"
+#endif
+#endif
+#ifdef AFS
+#include <kafs.h>
+#endif
 
 #include "ssh.h"
 #include "log.h"
@@ -40,7 +56,7 @@ initialize_server_options(ServerOptions *options)
         memset(options, 0, sizeof(*options));
 
         /* Portable-specific options */
-        options->use_pam = -1;
+        options->pam_authentication_via_kbd_int = -1;
 
         /* Standard Options */
         options->num_ports = 0;
@@ -64,16 +80,23 @@ initialize_server_options(ServerOptions *options)
         options->keepalives = -1;
         options->log_facility = SYSLOG_FACILITY_NOT_SET;
         options->log_level = SYSLOG_LEVEL_NOT_SET;
+        options->rhosts_authentication = -1;
         options->rhosts_rsa_authentication = -1;
         options->hostbased_authentication = -1;
         options->hostbased_uses_name_from_packet_only = -1;
         options->rsa_authentication = -1;
         options->pubkey_authentication = -1;
+#if defined(KRB4) || defined(KRB5)
         options->kerberos_authentication = -1;
         options->kerberos_or_local_passwd = -1;
         options->kerberos_ticket_cleanup = -1;
-        options->gss_authentication=-1;
-        options->gss_cleanup_creds = -1;
+#endif
+#if defined(AFS) || defined(KRB5)
+        options->kerberos_tgt_passing = -1;
+#endif
+#ifdef AFS
+        options->afs_token_passing = -1;
+#endif
         options->password_authentication = -1;
         options->kbd_interactive_authentication = -1;
         options->challenge_response_authentication = -1;
@@ -95,7 +118,7 @@ initialize_server_options(ServerOptions *options)
         options->max_startups_rate = -1;
         options->max_startups = -1;
         options->banner = NULL;
-        options->use_dns = -1;
+        options->verify_reverse_mapping = -1;
         options->client_alive_interval = -1;
         options->client_alive_count_max = -1;
         options->authorized_keys_file = NULL;
@@ -109,8 +132,8 @@ void
 fill_default_server_options(ServerOptions *options)
 {
         /* Portable-specific options */
-        if (options->use_pam == -1)
-                options->use_pam = 1;
+        if (options->pam_authentication_via_kbd_int == -1)
+                options->pam_authentication_via_kbd_int = 0;
 
         /* Standard Options */
         if (options->protocol == SSH_PROTO_UNKNOWN)
@@ -165,6 +188,8 @@ fill_default_server_options(ServerOptions *options)
                 options->log_facility = SYSLOG_FACILITY_AUTH;
         if (options->log_level == SYSLOG_LEVEL_NOT_SET)
                 options->log_level = SYSLOG_LEVEL_INFO;
+        if (options->rhosts_authentication == -1)
+                options->rhosts_authentication = 0;
         if (options->rhosts_rsa_authentication == -1)
                 options->rhosts_rsa_authentication = 0;
         if (options->hostbased_authentication == -1)
@@ -175,16 +200,22 @@ fill_default_server_options(ServerOptions *options)
                 options->rsa_authentication = 1;
         if (options->pubkey_authentication == -1)
                 options->pubkey_authentication = 1;
+#if defined(KRB4) || defined(KRB5)
         if (options->kerberos_authentication == -1)
                 options->kerberos_authentication = 0;
         if (options->kerberos_or_local_passwd == -1)
                 options->kerberos_or_local_passwd = 1;
         if (options->kerberos_ticket_cleanup == -1)
                 options->kerberos_ticket_cleanup = 1;
-        if (options->gss_authentication == -1)
-                options->gss_authentication = 0;
-        if (options->gss_cleanup_creds == -1)
-                options->gss_cleanup_creds = 1;
+#endif
+#if defined(AFS) || defined(KRB5)
+        if (options->kerberos_tgt_passing == -1)
+                options->kerberos_tgt_passing = 0;
+#endif
+#ifdef AFS
+        if (options->afs_token_passing == -1)
+                options->afs_token_passing = 0;
+#endif
         if (options->password_authentication == -1)
                 options->password_authentication = 1;
         if (options->kbd_interactive_authentication == -1)
@@ -209,8 +240,8 @@ fill_default_server_options(ServerOptions *options)
                 options->max_startups_rate = 100;               /* 100% */
         if (options->max_startups_begin == -1)
                 options->max_startups_begin = options->max_startups;
-        if (options->use_dns == -1)
-                options->use_dns = 1;
+        if (options->verify_reverse_mapping == -1)
+                options->verify_reverse_mapping = 0;
         if (options->client_alive_interval == -1)
                 options->client_alive_interval = 0;
         if (options->client_alive_count_max == -1)
@@ -244,13 +275,21 @@ fill_default_server_options(ServerOptions *options)
 typedef enum {
         sBadOption,             /* == unknown option */
         /* Portable-specific options */
-        sUsePAM,
+        sPAMAuthenticationViaKbdInt,
         /* Standard Options */
         sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime, sKeyRegenerationTime,
         sPermitRootLogin, sLogFacility, sLogLevel,
-        sRhostsRSAAuthentication, sRSAAuthentication,
+        sRhostsAuthentication, sRhostsRSAAuthentication, sRSAAuthentication,
+#if defined(KRB4) || defined(KRB5)
         sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
-        sKerberosTgtPassing, sChallengeResponseAuthentication,
+#endif
+#if defined(AFS) || defined(KRB5)
+        sKerberosTgtPassing,
+#endif
+#ifdef AFS
+        sAFSTokenPassing,
+#endif
+        sChallengeResponseAuthentication,
         sPasswordAuthentication, sKbdInteractiveAuthentication, sListenAddress,
         sPrintMotd, sPrintLastLog, sIgnoreRhosts,
         sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
@@ -259,12 +298,11 @@ typedef enum {
         sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
         sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
         sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem, sMaxStartups,
-        sBanner, sUseDNS, sHostbasedAuthentication,
+        sBanner, sVerifyReverseMapping, sHostbasedAuthentication,
         sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
         sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2,
-        sGssAuthentication, sGssCleanupCreds,
         sUsePrivilegeSeparation,
-        sDeprecated, sUnsupported
+        sDeprecated
 } ServerOpCodes;
 
 /* Textual representation of the tokens. */
@@ -273,12 +311,7 @@ static struct {
         ServerOpCodes opcode;
 } keywords[] = {
         /* Portable-specific options */
-#ifdef USE_PAM
-        { "usepam", sUsePAM },
-#else
-        { "usepam", sUnsupported },
-#endif
-        { "pamauthenticationviakbdint", sDeprecated },
+        { "PAMAuthenticationViaKbdInt", sPAMAuthenticationViaKbdInt },
         /* Standard Options */
         { "port", sPort },
         { "hostkey", sHostKeyFile },
@@ -290,30 +323,23 @@ static struct {
         { "permitrootlogin", sPermitRootLogin },
         { "syslogfacility", sLogFacility },
         { "loglevel", sLogLevel },
-        { "rhostsauthentication", sDeprecated },
+        { "rhostsauthentication", sRhostsAuthentication },
         { "rhostsrsaauthentication", sRhostsRSAAuthentication },
         { "hostbasedauthentication", sHostbasedAuthentication },
         { "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly },
         { "rsaauthentication", sRSAAuthentication },
         { "pubkeyauthentication", sPubkeyAuthentication },
         { "dsaauthentication", sPubkeyAuthentication },                 /* alias */
-#ifdef KRB5
+#if defined(KRB4) || defined(KRB5)
         { "kerberosauthentication", sKerberosAuthentication },
         { "kerberosorlocalpasswd", sKerberosOrLocalPasswd },
         { "kerberosticketcleanup", sKerberosTicketCleanup },
-#else
-        { "kerberosauthentication", sUnsupported },
-        { "kerberosorlocalpasswd", sUnsupported },
-        { "kerberosticketcleanup", sUnsupported },
 #endif
-        { "kerberostgtpassing", sUnsupported },
-        { "afstokenpassing", sUnsupported },
-#ifdef GSSAPI
-        { "gssapiauthentication", sGssAuthentication },
-        { "gssapicleanupcreds", sGssCleanupCreds },
-#else
-        { "gssapiauthentication", sUnsupported },
-        { "gssapicleanupcreds", sUnsupported },
+#if defined(AFS) || defined(KRB5)
+        { "kerberostgtpassing", sKerberosTgtPassing },
+#endif
+#ifdef AFS
+        { "afstokenpassing", sAFSTokenPassing },
 #endif
         { "passwordauthentication", sPasswordAuthentication },
         { "kbdinteractiveauthentication", sKbdInteractiveAuthentication },
@@ -347,9 +373,8 @@ static struct {
         { "subsystem", sSubsystem },
         { "maxstartups", sMaxStartups },
         { "banner", sBanner },
-        { "usedns", sUseDNS },
-        { "verifyreversemapping", sDeprecated },
-        { "reversemappingcheck", sDeprecated },
+        { "verifyreversemapping", sVerifyReverseMapping },
+        { "reversemappingcheck", sVerifyReverseMapping },
         { "clientaliveinterval", sClientAliveInterval },
         { "clientalivecountmax", sClientAliveCountMax },
         { "authorizedkeysfile", sAuthorizedKeysFile },
@@ -433,8 +458,8 @@ process_server_config_line(ServerOptions *options, char *line,
         opcode = parse_token(arg, filename, linenum);
         switch (opcode) {
         /* Portable-specific options */
-        case sUsePAM:
-                intptr = &options->use_pam;
+        case sPAMAuthenticationViaKbdInt:
+                intptr = &options->pam_authentication_via_kbd_int;
                 goto parse_flag;
 
         /* Standard Options */
@@ -597,6 +622,10 @@ parse_flag:
                 intptr = &options->ignore_user_known_hosts;
                 goto parse_flag;
 
+        case sRhostsAuthentication:
+                intptr = &options->rhosts_authentication;
+                goto parse_flag;
+
         case sRhostsRSAAuthentication:
                 intptr = &options->rhosts_rsa_authentication;
                 goto parse_flag;
@@ -616,7 +645,7 @@ parse_flag:
         case sPubkeyAuthentication:
                 intptr = &options->pubkey_authentication;
                 goto parse_flag;
-
+#if defined(KRB4) || defined(KRB5)
         case sKerberosAuthentication:
                 intptr = &options->kerberos_authentication;
                 goto parse_flag;
@@ -628,14 +657,17 @@ parse_flag:
         case sKerberosTicketCleanup:
                 intptr = &options->kerberos_ticket_cleanup;
                 goto parse_flag;
-
-        case sGssAuthentication:
-                intptr = &options->gss_authentication;
+#endif
+#if defined(AFS) || defined(KRB5)
+        case sKerberosTgtPassing:
+                intptr = &options->kerberos_tgt_passing;
                 goto parse_flag;
-
-        case sGssCleanupCreds:
-                intptr = &options->gss_cleanup_creds;
+#endif
+#ifdef AFS
+        case sAFSTokenPassing:
+                intptr = &options->afs_token_passing;
                 goto parse_flag;
+#endif
 
         case sPasswordAuthentication:
                 intptr = &options->password_authentication;
@@ -701,8 +733,8 @@ parse_flag:
                 intptr = &options->gateway_ports;
                 goto parse_flag;
 
-        case sUseDNS:
-                intptr = &options->use_dns;
+        case sVerifyReverseMapping:
+                intptr = &options->verify_reverse_mapping;
                 goto parse_flag;
 
         case sLogFacility:
@@ -878,14 +910,7 @@ parse_flag:
                 goto parse_int;
 
         case sDeprecated:
-                logit("%s line %d: Deprecated option %s",
-                    filename, linenum, arg);
-                while (arg)
-                    arg = strdelim(&cp);
-                break;
-
-        case sUnsupported:
-                logit("%s line %d: Unsupported option %s",
+                log("%s line %d: Deprecated option %s",
                     filename, linenum, arg);
                 while (arg)
                     arg = strdelim(&cp);