1 files changed, 61 insertions, 86 deletions

diff --git a/servconf.c b/servconf.c
index 2510659ee..71e28b3cb 100644
--- a/servconf.c
+++ b/servconf.c
@@ -10,23 +10,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: servconf.c,v 1.116 2003/02/21 09:05:53 markus Exp $");
-
-#if defined(KRB4)
-#include <krb.h>
-#endif
-#if defined(KRB5)
-#ifdef HEIMDAL
-#include <krb.h>
-#else
-/* Bodge - but then, so is using the kerberos IV KEYFILE to get a Kerberos V
- * keytab */
-#define KEYFILE "/etc/krb5.keytab"
-#endif
-#endif
-#ifdef AFS
-#include <kafs.h>
-#endif
+RCSID("$OpenBSD: servconf.c,v 1.127 2003/09/01 18:15:50 markus Exp $");
 
 #include "ssh.h"
 #include "log.h"
@@ -56,7 +40,7 @@ initialize_server_options(ServerOptions *options)
         memset(options, 0, sizeof(*options));
 
         /* Portable-specific options */
-        options->pam_authentication_via_kbd_int = -1;
+        options->use_pam = -1;
 
         /* Standard Options */
         options->num_ports = 0;
@@ -80,23 +64,16 @@ initialize_server_options(ServerOptions *options)
         options->keepalives = -1;
         options->log_facility = SYSLOG_FACILITY_NOT_SET;
         options->log_level = SYSLOG_LEVEL_NOT_SET;
-        options->rhosts_authentication = -1;
         options->rhosts_rsa_authentication = -1;
         options->hostbased_authentication = -1;
         options->hostbased_uses_name_from_packet_only = -1;
         options->rsa_authentication = -1;
         options->pubkey_authentication = -1;
-#if defined(KRB4) || defined(KRB5)
         options->kerberos_authentication = -1;
         options->kerberos_or_local_passwd = -1;
         options->kerberos_ticket_cleanup = -1;
-#endif
-#if defined(AFS) || defined(KRB5)
-        options->kerberos_tgt_passing = -1;
-#endif
-#ifdef AFS
-        options->afs_token_passing = -1;
-#endif
+        options->gss_authentication=-1;
+        options->gss_cleanup_creds = -1;
         options->password_authentication = -1;
         options->kbd_interactive_authentication = -1;
         options->challenge_response_authentication = -1;
@@ -118,7 +95,7 @@ initialize_server_options(ServerOptions *options)
         options->max_startups_rate = -1;
         options->max_startups = -1;
         options->banner = NULL;
-        options->verify_reverse_mapping = -1;
+        options->use_dns = -1;
         options->client_alive_interval = -1;
         options->client_alive_count_max = -1;
         options->authorized_keys_file = NULL;
@@ -132,8 +109,8 @@ void
 fill_default_server_options(ServerOptions *options)
 {
         /* Portable-specific options */
-        if (options->pam_authentication_via_kbd_int == -1)
-                options->pam_authentication_via_kbd_int = 0;
+        if (options->use_pam == -1)
+                options->use_pam = 1;
 
         /* Standard Options */
         if (options->protocol == SSH_PROTO_UNKNOWN)
@@ -188,8 +165,6 @@ fill_default_server_options(ServerOptions *options)
                 options->log_facility = SYSLOG_FACILITY_AUTH;
         if (options->log_level == SYSLOG_LEVEL_NOT_SET)
                 options->log_level = SYSLOG_LEVEL_INFO;
-        if (options->rhosts_authentication == -1)
-                options->rhosts_authentication = 0;
         if (options->rhosts_rsa_authentication == -1)
                 options->rhosts_rsa_authentication = 0;
         if (options->hostbased_authentication == -1)
@@ -200,22 +175,16 @@ fill_default_server_options(ServerOptions *options)
                 options->rsa_authentication = 1;
         if (options->pubkey_authentication == -1)
                 options->pubkey_authentication = 1;
-#if defined(KRB4) || defined(KRB5)
         if (options->kerberos_authentication == -1)
                 options->kerberos_authentication = 0;
         if (options->kerberos_or_local_passwd == -1)
                 options->kerberos_or_local_passwd = 1;
         if (options->kerberos_ticket_cleanup == -1)
                 options->kerberos_ticket_cleanup = 1;
-#endif
-#if defined(AFS) || defined(KRB5)
-        if (options->kerberos_tgt_passing == -1)
-                options->kerberos_tgt_passing = 0;
-#endif
-#ifdef AFS
-        if (options->afs_token_passing == -1)
-                options->afs_token_passing = 0;
-#endif
+        if (options->gss_authentication == -1)
+                options->gss_authentication = 0;
+        if (options->gss_cleanup_creds == -1)
+                options->gss_cleanup_creds = 1;
         if (options->password_authentication == -1)
                 options->password_authentication = 1;
         if (options->kbd_interactive_authentication == -1)
@@ -240,8 +209,8 @@ fill_default_server_options(ServerOptions *options)
                 options->max_startups_rate = 100;               /* 100% */
         if (options->max_startups_begin == -1)
                 options->max_startups_begin = options->max_startups;
-        if (options->verify_reverse_mapping == -1)
-                options->verify_reverse_mapping = 0;
+        if (options->use_dns == -1)
+                options->use_dns = 1;
         if (options->client_alive_interval == -1)
                 options->client_alive_interval = 0;
         if (options->client_alive_count_max == -1)
@@ -275,21 +244,13 @@ fill_default_server_options(ServerOptions *options)
 typedef enum {
         sBadOption,             /* == unknown option */
         /* Portable-specific options */
-        sPAMAuthenticationViaKbdInt,
+        sUsePAM,
         /* Standard Options */
         sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime, sKeyRegenerationTime,
         sPermitRootLogin, sLogFacility, sLogLevel,
-        sRhostsAuthentication, sRhostsRSAAuthentication, sRSAAuthentication,
-#if defined(KRB4) || defined(KRB5)
+        sRhostsRSAAuthentication, sRSAAuthentication,
         sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
-#endif
-#if defined(AFS) || defined(KRB5)
-        sKerberosTgtPassing,
-#endif
-#ifdef AFS
-        sAFSTokenPassing,
-#endif
-        sChallengeResponseAuthentication,
+        sKerberosTgtPassing, sChallengeResponseAuthentication,
         sPasswordAuthentication, sKbdInteractiveAuthentication, sListenAddress,
         sPrintMotd, sPrintLastLog, sIgnoreRhosts,
         sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
@@ -298,11 +259,12 @@ typedef enum {
         sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
         sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
         sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem, sMaxStartups,
-        sBanner, sVerifyReverseMapping, sHostbasedAuthentication,
+        sBanner, sUseDNS, sHostbasedAuthentication,
         sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
         sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2,
+        sGssAuthentication, sGssCleanupCreds,
         sUsePrivilegeSeparation,
-        sDeprecated
+        sDeprecated, sUnsupported
 } ServerOpCodes;
 
 /* Textual representation of the tokens. */
@@ -311,7 +273,12 @@ static struct {
         ServerOpCodes opcode;
 } keywords[] = {
         /* Portable-specific options */
-        { "PAMAuthenticationViaKbdInt", sPAMAuthenticationViaKbdInt },
+#ifdef USE_PAM
+        { "usepam", sUsePAM },
+#else
+        { "usepam", sUnsupported },
+#endif
+        { "pamauthenticationviakbdint", sDeprecated },
         /* Standard Options */
         { "port", sPort },
         { "hostkey", sHostKeyFile },
@@ -323,23 +290,30 @@ static struct {
         { "permitrootlogin", sPermitRootLogin },
         { "syslogfacility", sLogFacility },
         { "loglevel", sLogLevel },
-        { "rhostsauthentication", sRhostsAuthentication },
+        { "rhostsauthentication", sDeprecated },
         { "rhostsrsaauthentication", sRhostsRSAAuthentication },
         { "hostbasedauthentication", sHostbasedAuthentication },
         { "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly },
         { "rsaauthentication", sRSAAuthentication },
         { "pubkeyauthentication", sPubkeyAuthentication },
         { "dsaauthentication", sPubkeyAuthentication },                 /* alias */
-#if defined(KRB4) || defined(KRB5)
+#ifdef KRB5
         { "kerberosauthentication", sKerberosAuthentication },
         { "kerberosorlocalpasswd", sKerberosOrLocalPasswd },
         { "kerberosticketcleanup", sKerberosTicketCleanup },
+#else
+        { "kerberosauthentication", sUnsupported },
+        { "kerberosorlocalpasswd", sUnsupported },
+        { "kerberosticketcleanup", sUnsupported },
 #endif
-#if defined(AFS) || defined(KRB5)
-        { "kerberostgtpassing", sKerberosTgtPassing },
-#endif
-#ifdef AFS
-        { "afstokenpassing", sAFSTokenPassing },
+        { "kerberostgtpassing", sUnsupported },
+        { "afstokenpassing", sUnsupported },
+#ifdef GSSAPI
+        { "gssapiauthentication", sGssAuthentication },
+        { "gssapicleanupcreds", sGssCleanupCreds },
+#else
+        { "gssapiauthentication", sUnsupported },
+        { "gssapicleanupcreds", sUnsupported },
 #endif
         { "passwordauthentication", sPasswordAuthentication },
         { "kbdinteractiveauthentication", sKbdInteractiveAuthentication },
@@ -373,8 +347,9 @@ static struct {
         { "subsystem", sSubsystem },
         { "maxstartups", sMaxStartups },
         { "banner", sBanner },
-        { "verifyreversemapping", sVerifyReverseMapping },
-        { "reversemappingcheck", sVerifyReverseMapping },
+        { "usedns", sUseDNS },
+        { "verifyreversemapping", sDeprecated },
+        { "reversemappingcheck", sDeprecated },
         { "clientaliveinterval", sClientAliveInterval },
         { "clientalivecountmax", sClientAliveCountMax },
         { "authorizedkeysfile", sAuthorizedKeysFile },
@@ -458,8 +433,8 @@ process_server_config_line(ServerOptions *options, char *line,
         opcode = parse_token(arg, filename, linenum);
         switch (opcode) {
         /* Portable-specific options */
-        case sPAMAuthenticationViaKbdInt:
-                intptr = &options->pam_authentication_via_kbd_int;
+        case sUsePAM:
+                intptr = &options->use_pam;
                 goto parse_flag;
 
         /* Standard Options */
@@ -622,10 +597,6 @@ parse_flag:
                 intptr = &options->ignore_user_known_hosts;
                 goto parse_flag;
 
-        case sRhostsAuthentication:
-                intptr = &options->rhosts_authentication;
-                goto parse_flag;
-
         case sRhostsRSAAuthentication:
                 intptr = &options->rhosts_rsa_authentication;
                 goto parse_flag;
@@ -645,7 +616,7 @@ parse_flag:
         case sPubkeyAuthentication:
                 intptr = &options->pubkey_authentication;
                 goto parse_flag;
-#if defined(KRB4) || defined(KRB5)
+
         case sKerberosAuthentication:
                 intptr = &options->kerberos_authentication;
                 goto parse_flag;
@@ -657,17 +628,14 @@ parse_flag:
         case sKerberosTicketCleanup:
                 intptr = &options->kerberos_ticket_cleanup;
                 goto parse_flag;
-#endif
-#if defined(AFS) || defined(KRB5)
-        case sKerberosTgtPassing:
-                intptr = &options->kerberos_tgt_passing;
+
+        case sGssAuthentication:
+                intptr = &options->gss_authentication;
                 goto parse_flag;
-#endif
-#ifdef AFS
-        case sAFSTokenPassing:
-                intptr = &options->afs_token_passing;
+
+        case sGssCleanupCreds:
+                intptr = &options->gss_cleanup_creds;
                 goto parse_flag;
-#endif
 
         case sPasswordAuthentication:
                 intptr = &options->password_authentication;
@@ -733,8 +701,8 @@ parse_flag:
                 intptr = &options->gateway_ports;
                 goto parse_flag;
 
-        case sVerifyReverseMapping:
-                intptr = &options->verify_reverse_mapping;
+        case sUseDNS:
+                intptr = &options->use_dns;
                 goto parse_flag;
 
         case sLogFacility:
@@ -910,7 +878,14 @@ parse_flag:
                 goto parse_int;
 
         case sDeprecated:
-                log("%s line %d: Deprecated option %s",
+                logit("%s line %d: Deprecated option %s",
+                    filename, linenum, arg);
+                while (arg)
+                    arg = strdelim(&cp);
+                break;
+
+        case sUnsupported:
+                logit("%s line %d: Unsupported option %s",
                     filename, linenum, arg);
                 while (arg)
                     arg = strdelim(&cp);