diff options
Diffstat (limited to 'ssh.c')
-rw-r--r-- | ssh.c | 35 |
1 files changed, 5 insertions, 30 deletions
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: ssh.c,v 1.484 2018/07/16 07:06:50 djm Exp $ */ | 1 | /* $OpenBSD: ssh.c,v 1.485 2018/07/16 11:05:41 dtucker Exp $ */ |
2 | /* | 2 | /* |
3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
@@ -1411,16 +1411,12 @@ main(int ac, char **av) | |||
1411 | debug3("timeout: %d ms remain after connect", timeout_ms); | 1411 | debug3("timeout: %d ms remain after connect", timeout_ms); |
1412 | 1412 | ||
1413 | /* | 1413 | /* |
1414 | * If we successfully made the connection, load the host private key | 1414 | * If we successfully made the connection and we have hostbased auth |
1415 | * in case we will need it later for hostbased | 1415 | * enabled, load the public keys so we can later use the ssh-keysign |
1416 | * authentication. This must be done before releasing extra | 1416 | * helper to sign challenges. |
1417 | * privileges, because the file is only readable by root. | ||
1418 | * If we cannot access the private keys, load the public keys | ||
1419 | * instead and try to execute the ssh-keysign helper instead. | ||
1420 | */ | 1417 | */ |
1421 | sensitive_data.nkeys = 0; | 1418 | sensitive_data.nkeys = 0; |
1422 | sensitive_data.keys = NULL; | 1419 | sensitive_data.keys = NULL; |
1423 | sensitive_data.external_keysign = 0; | ||
1424 | if (options.hostbased_authentication) { | 1420 | if (options.hostbased_authentication) { |
1425 | sensitive_data.nkeys = 11; | 1421 | sensitive_data.nkeys = 11; |
1426 | sensitive_data.keys = xcalloc(sensitive_data.nkeys, | 1422 | sensitive_data.keys = xcalloc(sensitive_data.nkeys, |
@@ -1439,27 +1435,7 @@ main(int ac, char **av) | |||
1439 | #define L_CERT(p,o) \ | 1435 | #define L_CERT(p,o) \ |
1440 | check_load(sshkey_load_cert(p, &(sensitive_data.keys[o])), p, "cert") | 1436 | check_load(sshkey_load_cert(p, &(sensitive_data.keys[o])), p, "cert") |
1441 | 1437 | ||
1442 | PRIV_START; | 1438 | if (options.hostbased_authentication == 1) { |
1443 | L_KEYCERT(KEY_ECDSA, _PATH_HOST_ECDSA_KEY_FILE, 1); | ||
1444 | L_KEYCERT(KEY_ED25519, _PATH_HOST_ED25519_KEY_FILE, 2); | ||
1445 | L_KEYCERT(KEY_RSA, _PATH_HOST_RSA_KEY_FILE, 3); | ||
1446 | L_KEYCERT(KEY_DSA, _PATH_HOST_DSA_KEY_FILE, 4); | ||
1447 | L_KEY(KEY_ECDSA, _PATH_HOST_ECDSA_KEY_FILE, 5); | ||
1448 | L_KEY(KEY_ED25519, _PATH_HOST_ED25519_KEY_FILE, 6); | ||
1449 | L_KEY(KEY_RSA, _PATH_HOST_RSA_KEY_FILE, 7); | ||
1450 | L_KEY(KEY_DSA, _PATH_HOST_DSA_KEY_FILE, 8); | ||
1451 | L_KEYCERT(KEY_XMSS, _PATH_HOST_XMSS_KEY_FILE, 9); | ||
1452 | L_KEY(KEY_XMSS, _PATH_HOST_XMSS_KEY_FILE, 10); | ||
1453 | PRIV_END; | ||
1454 | |||
1455 | if (options.hostbased_authentication == 1 && | ||
1456 | sensitive_data.keys[0] == NULL && | ||
1457 | sensitive_data.keys[5] == NULL && | ||
1458 | sensitive_data.keys[6] == NULL && | ||
1459 | sensitive_data.keys[7] == NULL && | ||
1460 | sensitive_data.keys[8] == NULL && | ||
1461 | sensitive_data.keys[9] == NULL && | ||
1462 | sensitive_data.keys[10] == NULL) { | ||
1463 | L_CERT(_PATH_HOST_ECDSA_KEY_FILE, 1); | 1439 | L_CERT(_PATH_HOST_ECDSA_KEY_FILE, 1); |
1464 | L_CERT(_PATH_HOST_ED25519_KEY_FILE, 2); | 1440 | L_CERT(_PATH_HOST_ED25519_KEY_FILE, 2); |
1465 | L_CERT(_PATH_HOST_RSA_KEY_FILE, 3); | 1441 | L_CERT(_PATH_HOST_RSA_KEY_FILE, 3); |
@@ -1470,7 +1446,6 @@ main(int ac, char **av) | |||
1470 | L_PUBKEY(_PATH_HOST_DSA_KEY_FILE, 8); | 1446 | L_PUBKEY(_PATH_HOST_DSA_KEY_FILE, 8); |
1471 | L_CERT(_PATH_HOST_XMSS_KEY_FILE, 9); | 1447 | L_CERT(_PATH_HOST_XMSS_KEY_FILE, 9); |
1472 | L_PUBKEY(_PATH_HOST_XMSS_KEY_FILE, 10); | 1448 | L_PUBKEY(_PATH_HOST_XMSS_KEY_FILE, 10); |
1473 | sensitive_data.external_keysign = 1; | ||
1474 | } | 1449 | } |
1475 | } | 1450 | } |
1476 | /* | 1451 | /* |