1 files changed, 29 insertions, 10 deletions

diff --git a/servconf.c b/servconf.c
index df93fc450..6c7a91e6b 100644
--- a/servconf.c
+++ b/servconf.c
@@ -1,4 +1,5 @@
-/* $OpenBSD: servconf.c,v 1.274 2015/07/01 02:32:17 djm Exp $ */
+
+/* $OpenBSD: servconf.c,v 1.280 2015/08/06 14:53:21 deraadt Exp $ */
 /*
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
@@ -107,6 +108,7 @@ initialize_server_options(ServerOptions *options)
         options->hostbased_authentication = -1;
         options->hostbased_uses_name_from_packet_only = -1;
         options->hostbased_key_types = NULL;
+        options->hostkeyalgorithms = NULL;
         options->rsa_authentication = -1;
         options->pubkey_authentication = -1;
         options->pubkey_key_types = NULL;
@@ -222,7 +224,7 @@ fill_default_server_options(ServerOptions *options)
         if (options->key_regeneration_time == -1)
                 options->key_regeneration_time = 3600;
         if (options->permit_root_login == PERMIT_NOT_SET)
-                options->permit_root_login = PERMIT_YES;
+                options->permit_root_login = PERMIT_NO_PASSWD;
         if (options->ignore_rhosts == -1)
                 options->ignore_rhosts = 1;
         if (options->ignore_user_known_hosts == -1)
@@ -257,14 +259,12 @@ fill_default_server_options(ServerOptions *options)
                 options->hostbased_authentication = 0;
         if (options->hostbased_uses_name_from_packet_only == -1)
                 options->hostbased_uses_name_from_packet_only = 0;
-        if (options->hostbased_key_types == NULL)
-                options->hostbased_key_types = xstrdup("*");
+        if (options->hostkeyalgorithms == NULL)
+                options->hostkeyalgorithms = xstrdup(KEX_DEFAULT_PK_ALG);
         if (options->rsa_authentication == -1)
                 options->rsa_authentication = 1;
         if (options->pubkey_authentication == -1)
                 options->pubkey_authentication = 1;
-        if (options->pubkey_key_types == NULL)
-                options->pubkey_key_types = xstrdup("*");
         if (options->kerberos_authentication == -1)
                 options->kerberos_authentication = 0;
         if (options->kerberos_or_local_passwd == -1)
@@ -341,6 +341,16 @@ fill_default_server_options(ServerOptions *options)
                 options->fwd_opts.streamlocal_bind_unlink = 0;
         if (options->fingerprint_hash == -1)
                 options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
+
+        if (kex_assemble_names(KEX_SERVER_ENCRYPT, &options->ciphers) != 0 ||
+            kex_assemble_names(KEX_SERVER_MAC, &options->macs) != 0 ||
+            kex_assemble_names(KEX_SERVER_KEX, &options->kex_algorithms) != 0 ||
+            kex_assemble_names(KEX_DEFAULT_PK_ALG,
+            &options->hostbased_key_types) != 0 ||
+            kex_assemble_names(KEX_DEFAULT_PK_ALG,
+            &options->pubkey_key_types) != 0)
+                fatal("%s: kex_assemble_names failed", __func__);
+
         /* Turn privilege separation on by default */
         if (use_privsep == -1)
                 use_privsep = PRIVSEP_NOSANDBOX;
@@ -399,6 +409,7 @@ typedef enum {
         sXAuthLocation, sSubsystem, sMaxStartups, sMaxAuthTries, sMaxSessions,
         sBanner, sUseDNS, sHostbasedAuthentication,
         sHostbasedUsesNameFromPacketOnly, sHostbasedAcceptedKeyTypes,
+        sHostKeyAlgorithms,
         sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile,
         sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor,
         sAcceptEnv, sPermitTunnel,
@@ -449,6 +460,7 @@ static struct {
         { "hostbasedauthentication", sHostbasedAuthentication, SSHCFG_ALL },
         { "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly, SSHCFG_ALL },
         { "hostbasedacceptedkeytypes", sHostbasedAcceptedKeyTypes, SSHCFG_ALL },
+        { "hostkeyalgorithms", sHostKeyAlgorithms, SSHCFG_GLOBAL },
         { "rsaauthentication", sRSAAuthentication, SSHCFG_ALL },
         { "pubkeyauthentication", sPubkeyAuthentication, SSHCFG_ALL },
         { "pubkeyacceptedkeytypes", sPubkeyAcceptedKeyTypes, SSHCFG_ALL },
@@ -904,6 +916,7 @@ static const struct multistate multistate_addressfamily[] = {
 };
 static const struct multistate multistate_permitrootlogin[] = {
         { "without-password",           PERMIT_NO_PASSWD },
+        { "prohibit-password",          PERMIT_NO_PASSWD },
         { "forced-commands-only",       PERMIT_FORCED_ONLY },
         { "yes",                        PERMIT_YES },
         { "no",                         PERMIT_NO },
@@ -1175,13 +1188,17 @@ process_server_config_line(ServerOptions *options, char *line,
                 if (!arg || *arg == '\0')
                         fatal("%s line %d: Missing argument.",
                             filename, linenum);
-                if (!sshkey_names_valid2(arg, 1))
+                if (!sshkey_names_valid2(*arg == '+' ? arg + 1 : arg, 1))
                         fatal("%s line %d: Bad key types '%s'.",
                             filename, linenum, arg ? arg : "<NONE>");
                 if (*activep && *charptr == NULL)
                         *charptr = xstrdup(arg);
                 break;
 
+        case sHostKeyAlgorithms:
+                charptr = &options->hostkeyalgorithms;
+                goto parse_keytypes;
+
         case sRSAAuthentication:
                 intptr = &options->rsa_authentication;
                 goto parse_flag;
@@ -1424,7 +1441,7 @@ process_server_config_line(ServerOptions *options, char *line,
                 arg = strdelim(&cp);
                 if (!arg || *arg == '\0')
                         fatal("%s line %d: Missing argument.", filename, linenum);
-                if (!ciphers_valid(arg))
+                if (!ciphers_valid(*arg == '+' ? arg + 1 : arg))
                         fatal("%s line %d: Bad SSH2 cipher spec '%s'.",
                             filename, linenum, arg ? arg : "<NONE>");
                 if (options->ciphers == NULL)
@@ -1435,7 +1452,7 @@ process_server_config_line(ServerOptions *options, char *line,
                 arg = strdelim(&cp);
                 if (!arg || *arg == '\0')
                         fatal("%s line %d: Missing argument.", filename, linenum);
-                if (!mac_valid(arg))
+                if (!mac_valid(*arg == '+' ? arg + 1 : arg))
                         fatal("%s line %d: Bad SSH2 mac spec '%s'.",
                             filename, linenum, arg ? arg : "<NONE>");
                 if (options->macs == NULL)
@@ -1447,7 +1464,7 @@ process_server_config_line(ServerOptions *options, char *line,
                 if (!arg || *arg == '\0')
                         fatal("%s line %d: Missing argument.",
                             filename, linenum);
-                if (!kex_names_valid(arg))
+                if (!kex_names_valid(*arg == '+' ? arg + 1 : arg))
                         fatal("%s line %d: Bad SSH2 KexAlgorithms '%s'.",
                             filename, linenum, arg ? arg : "<NONE>");
                 if (options->kex_algorithms == NULL)
@@ -2279,6 +2296,8 @@ dump_config(ServerOptions *o)
             o->kex_algorithms ? o->kex_algorithms : KEX_SERVER_KEX);
         dump_cfg_string(sHostbasedAcceptedKeyTypes, o->hostbased_key_types ?
             o->hostbased_key_types : KEX_DEFAULT_PK_ALG);
+        dump_cfg_string(sHostKeyAlgorithms, o->hostkeyalgorithms ?
+            o->hostkeyalgorithms : KEX_DEFAULT_PK_ALG);
         dump_cfg_string(sPubkeyAcceptedKeyTypes, o->pubkey_key_types ?
             o->pubkey_key_types : KEX_DEFAULT_PK_ALG);